PT-2025-3930 · Sparkle+1 · Sparkle+1

Zorgiepoo · Published 2024-04-30 · Updated 2026-05-08 · CVE-2025-0509

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sparkle versions prior to 2.6.4

Description A security issue was found in Sparkle, where an attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks. This allows the attacker to potentially install malicious software.

Recommendations For versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of Sparkle’s update mechanism until a patch is applied.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2025-09248

BIT-JAVA-2025-0509

BIT-JAVA-MIN-2025-0509

BIT-JRE-2025-0509

CVE-2025-0509

GHSA-WC9M-R3V6-9P5H

Affected Products

Java Platform

Sparkle

References · 20

• https://github.com/sparkle-project/Sparkle/pull/2550 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0509 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20250124-0008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0509 · Security Note
• https://sparkle-project.org/documentation/security-and-reliability · Patch
• https://osv.dev/vulnerability/BIT-java-min-2025-0509 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc9m-r3v6-9p5h · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0509 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-2025-0509 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-0509 · Security Note
• https://bdu.fstec.ru/vul/2025-09248 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0509 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jre-2025-0509 · Vendor Advisory
• https://github.com/sparkle-project/Sparkle · Note
• https://twitter.com/dailycve/status/1952760353093247436 · Twitter Post