PT-2025-50090 · Yandex · Yandex Telemost

Published 2025-07-22 · Updated 2026-02-19 · CVE-2025-5471

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yandex Telemost versions prior to 2.19.1

Description An uncontrolled search path element issue exists in Yandex Telemost on MacOS, enabling search order hijacking. This allows an attacker to potentially manipulate the system's search path to load malicious code.

Recommendations Update Yandex Telemost to version 2.19.1 or later.

Fix

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

BDU:2025-08835

CVE-2025-5471

Affected Products

Yandex Telemost

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-5471 · Security Note
• https://yandex.com/bugbounty/i/hall-of-fame-products · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5471 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08835 · Security Note
• https://twitter.com/CVEnew/status/2000248704939520459 · Twitter Post
• https://t.me/cveNotify/152473 · Telegram Post