CVE-2025-30057

9.4 criticalEPSS 0.7%

Critical (9.4). EPSS 0.7% chance of exploitation in the next 30 days.

In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2025-08-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://cert.pl/en/posts/2025/08/CVE-2025-2313/

Check your stack JSON