CVE-2025-10577

HighCVSS 8.5/10Last modified Oct 8, 2026

Description

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-266

Affected software

VendorProductVersions
HP, Inc.Sound ResearchSee HP security bulletin reference for affected versions

References

Timeline

Published
Oct 15, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-105787.8A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could CVE-2025-105795.3The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabiliCVE-2025-10588.1CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is doCVE-2025-105806.4The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via muCVE-2025-105817.8A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a loCVE-2025-105828.8The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 dueCVE-2025-105833.5The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 vCVE-2025-105845.4A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anCVE-2025-105859.8Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a craftedCVE-2025-105869.8The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and includinCVE-2025-105879.8The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and includiCVE-2025-105884.3The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up