CVE-2025-63701

{
  "id": "CVE-2025-63701",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-14T20:15:47.717",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an undersized output buffer. The driver incorrectly assumes the output buffer size matches the input buffer size, leading to invalid memory operations and heap corruption. This vulnerability can cause denial of service through application crashes and potentially lead to code execution in user space. Local access is required to exploit this vulnerability."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de corrupción de heap existe en el DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) del controlador de impresora Advantech TP-3250 cuando se llama a DocumentPropertiesW() con un valor dmDriverExtra válido pero un búfer de salida de tamaño insuficiente. El controlador asume incorrectamente que el tamaño del búfer de salida coincide con el tamaño del búfer de entrada, lo que lleva a operaciones de memoria no válidas y corrupción de heap. Esta vulnerabilidad puede causar denegación de servicio a través de bloqueos de aplicaciones y potencialmente conducir a la ejecución de código en espacio de usuario. Se requiere acceso local para explotar esta vulnerabilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-14T21:34:37.885595Z",
          "id": "CVE-2025-63701",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:advantech:tp_3250_firmware:0.3.9200.20789:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D4139D9-0273-4AAD-A4F1-05E2085C5632"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:advantech:tp_3250:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B85D991C-1737-4025-9AE5-B86F8E82E4C7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://neurowinter.com/security/2025/10/08/Heap-Corruption-in-Advantech-TP-3250-Printer-Driver/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}