CVE-2025-1364

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passPrompt of the component USB Protection Service. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136403.5Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via phys CVE-2025-136418.8The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions CVE-2025-136425.4The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre CVE-2025-136436.5A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other CVE-2025-136447.5MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the serve CVE-2025-136457.2The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax CVE-2025-136466.6The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip CVE-2025-136486.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulne CVE-2025-136496.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the acti CVE-2025-13657.8A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file rea CVE-2025-136506.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action CVE-2025-136517.5Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of