PT-2025-54472 · Kde+2 · Kde Messagelib+2

Published 2025-12-31 · Updated 2026-03-10 · CVE-2025-69412

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KDE messagelib versions prior to 25.11.90

Description The software does not properly handle SSL errors when using the Google Safe Browsing Lookup API, potentially allowing for spoofing of threat data. This issue affects the find function within the threatMatches component of the API. The Google Safe Browsing Lookup API is not used by default in the messagelib configuration.

Recommendations Update to version 25.11.90 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2026-03574

CVE-2025-69412

OESA-2026-1039

OESA-2026-1040

OESA-2026-1041

OESA-2026-1042

Affected Products

Debian

Kde Messagelib

Red Os

References · 27

• https://ubuntu.com/security/CVE-2025-69412 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69412 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1040 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69412 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03574 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69412 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69412 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69412 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69412 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1042 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1041 · Vendor Advisory
• https://github.com/KDE/messagelib/compare/v25.11.80...v25.11.90 · Note
• https://github.com/KDE/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3 · Note
• https://t.me/CVEtracker/41143 · Telegram Post