الثغرات ›

CVE-2025-59613

متوسط

CWE-121 — نوع الضعف

                    نُشر: Jun 1, 2026                      ·  آخر تحديث: Jun 4, 2026                      ·  المصدر: NVD                

CVSS v3

6.7

🔗 NVD الرسمي

📄 الوصف (الإنجليزية)

Memory Corruption when output buffer size is smaller than input buffer size during data copying operation.

🤖 ملخص AI

CVE-2025-59613 is a memory corruption vulnerability (CWE-121: Stack-based Buffer Overflow) with a CVSS score of 6.7 that occurs when output buffer sizes are smaller than input buffer sizes during data copying operations. Without an available patch and no specified affected products, organizations must implement immediate compensating controls and monitoring. The vulnerability poses a moderate risk of denial of service and potential code execution depending on exploitation context.

📄 الوصف (العربية)

🤖 التحليل الذكي آخر تحليل: Jun 2, 2026 02:17

🇸🇦 التأثير على المملكة العربية السعودية

This vulnerability primarily impacts organizations using unpatched software with buffer overflow vulnerabilities in data processing operations. Saudi banking sector (SAMA-regulated institutions), government agencies (NCA oversight), healthcare providers, and energy sector organizations (ARAMCO, downstream operators) are at risk if affected products are deployed in their infrastructure. Telecommunications providers (STC, Mobily, Zain) handling customer data are particularly vulnerable. The lack of specified affected products requires broad inventory assessment across all sectors to identify exposure.

🏢 القطاعات السعودية المتأثرة

Banking and Financial Services Government and Public Administration Healthcare and Medical Services Energy and Utilities Telecommunications Critical Infrastructure Defense and Security

🎯 تقنيات MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1499 - Endpoint Denial of Service T1055 - Process Injection T1543 - Create or Modify System Process

⚖️ درجة المخاطر السعودية (AI)

6.2

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Conduct comprehensive software inventory audit to identify potentially affected products and versions

2. Implement input validation and bounds checking in all data copying operations

3. Enable Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) at OS level

4. Deploy stack canaries and buffer overflow detection mechanisms

5. Isolate critical systems handling sensitive data until patch availability confirmed



Compensating Controls:

6. Implement strict input size validation before buffer operations

7. Use safe string handling functions (strncpy, strlcpy instead of strcpy)

8. Deploy Web Application Firewalls (WAF) to detect abnormal data sizes

9. Enable comprehensive logging of buffer operations and memory access violations

10. Implement network segmentation to limit lateral movement if exploitation occurs



Detection Rules:

11. Monitor for abnormal process memory allocation patterns

12. Alert on stack overflow exceptions and segmentation faults

13. Track unusual data copy operations with size mismatches

14. Monitor for unexpected process terminations in critical applications

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. إجراء تدقيق شامل لمخزون البرامج لتحديد المنتجات والإصدارات المحتملة المتأثرة

2. تنفيذ التحقق من صحة الإدخال والتحقق من الحدود في جميع عمليات نسخ البيانات

3. تفعيل عشوائية تخطيط مساحة العنوان (ASLR) ومنع تنفيذ البيانات (DEP) على مستوى نظام التشغيل

4. تنفيذ كاشفات المكدس والآليات الكاشفة لتجاوز المخزن المؤقت

5. عزل الأنظمة الحرجة التي تتعامل مع البيانات الحساسة حتى يتم تأكيد توفر التصحيح

الضوابط التعويضية:

6. تنفيذ التحقق الصارم من حجم الإدخال قبل عمليات المخزن المؤقت

7. استخدام وظائف معالجة السلاسل الآمنة (strncpy, strlcpy بدلاً من strcpy)

8. نشر جدران حماية تطبيقات الويب (WAF) للكشف عن أحجام البيانات غير الطبيعية

9. تفعيل السجلات الشاملة لعمليات المخزن المؤقت وانتهاكات الوصول إلى الذاكرة

10. تنفيذ تقسيم الشبكة لتحديد الحركة الجانبية في حالة الاستغلال

قواعد الكشف:

11. مراقبة أنماط تخصيص ذاكرة العملية غير الطبيعية

12. التنبيه على استثناءات تجاوز المكدس وأخطاء انتهاك الحماية

13. تتبع عمليات نسخ البيانات غير العادية مع عدم تطابق الأحجام

14. مراقبة إنهاء العملية غير المتوقع في التطبيقات الحرجة

📋 خريطة الامتثال التنظيمي

🟢 NCA ECC 2024

ECC 2024 A.14.2.1 - Secure development policy and procedures ECC 2024 A.14.2.5 - Secure development environment ECC 2024 A.12.6.1 - Management of technical vulnerabilities ECC 2024 A.12.2.1 - Monitoring and logging of access to information

🔵 SAMA CSF

SAMA CSF ID.BE-1 - Asset management and inventory SAMA CSF PR.DS-6 - Data is protected from unauthorized access SAMA CSF DE.CM-1 - The network is monitored to detect potential cybersecurity events SAMA CSF RS.MI-2 - Incidents are mitigated

🟡 ISO 27001:2022

ISO 27001:2022 A.8.1 - Organizational controls for information security ISO 27001:2022 A.14.2.1 - Secure development policy ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities ISO 27001:2022 A.8.3 - Segregation of duties

🟣 PCI DSS v4.0.1

PCI DSS 6.2 - Ensure all system components and software are protected from known vulnerabilities PCI DSS 11.2 - Run automated vulnerability scanning tools regularly

🔗 المراجع والمصادر 1

🔗

https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2026-bulletin.html

product-security@qualcomm.com

Vendor Advisory

📦 المنتجات المتأثرة 44 منتج

qualcomm:cologne_firmware:-

qualcomm:fastconnect_6700_firmware:-

qualcomm:fastconnect_6900_firmware:-

qualcomm:fastconnect_7800_firmware:-

qualcomm:iqx5121_firmware:-

qualcomm:iqx7181_firmware:-

qualcomm:qca0000_firmware:-

qualcomm:qcm5430_firmware:-

qualcomm:qcm6490_firmware:-

qualcomm:video_collaboration_vc3_platform_firmware:-

qualcomm:sc8380xp_firmware:-

qualcomm:sd865_5g_firmware:-

qualcomm:snapdragon_460_mobile_platform_firmware:-

qualcomm:snapdragon_662_mobile_platform_firmware:-

qualcomm:snapdragon_7c\+_gen_3_compute_firmware:-

qualcomm:snapdragon_8cx_gen_3_compute_platform_firmware:-

qualcomm:snapdragon_ar1_gen_1_platform_firmware:-

qualcomm:snapdragon_xr2_5g_platform_firmware:-

qualcomm:snapdragon_xr2\+_gen_1_platform_firmware:-

qualcomm:sxr2230p_firmware:-

qualcomm:sxr2250p_firmware:-

qualcomm:wcd9370_firmware:-

qualcomm:wcd9375_firmware:-

qualcomm:wcd9378c_firmware:-

qualcomm:wcd9380_firmware:-

qualcomm:wcd9385_firmware:-

qualcomm:wcn3950_firmware:-

qualcomm:wcn3988_firmware:-

qualcomm:wsa8810_firmware:-

qualcomm:wsa8815_firmware:-

qualcomm:wsa8830_firmware:-

qualcomm:wsa8832_firmware:-

qualcomm:wsa8835_firmware:-

qualcomm:wsa8840_firmware:-

qualcomm:wsa8845_firmware:-

qualcomm:wsa8845h_firmware:-

qualcomm:x2000077_firmware:-

qualcomm:x2000086_firmware:-

qualcomm:x2000090_firmware:-

qualcomm:x2000092_firmware:-

qualcomm:x2000094_firmware:-

qualcomm:xg101002_firmware:-

qualcomm:xg101032_firmware:-

qualcomm:xg101039_firmware:-

📊 CVSS Score

6.7

/ 10.0 — متوسط

📊 CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityL — Low / Local

Privileges RequiredH — High

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 حقائق سريعة

الخطورة متوسط

CVSS Score6.7

CWECWE-121

EPSS0.01%

اختراق متاح لا

تصحيح متاح ✗ لا

تاريخ النشر 2026-06-01

المصدر nvd

المشاهدات 2

🇸🇦 درجة المخاطر السعودية

6.2

/ 10.0 — مخاطر السعودية

أولوية: HIGH

🏷️ الوسوم

CWE-121

🏢 توجيهات البائع

🔗 https://docs.qualcomm.com/product/publicresources/se...

⚡ إجراءات

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2025-59613

عرّفنا بنفسك

تسجيل الدخول مطلوب