PT-2025-7781 · Tex Live+2 · Tex Live+2

Vicevirus · CVE-2025-26525 · Published 2025-02-18 · Updated 2025-11-27

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TeX Live (affected versions not specified)

Description The issue is related to insufficient sanitizing in the TeX notation filter, which poses an arbitrary file read risk on sites where pdfTeX is available. This typically affects systems with TeX Live installed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Files Accessible to External Parties

Information Disclosure

Weakness Enumeration

CWE-552

CWE-200

Related Identifiers

ALT-PU-2025-6924

ALT-PU-2025-7344

BDU:2025-02323

BIT-MOODLE-2025-26525

CVE-2025-26525

GHSA-4HMR-39VP-XFRR

Affected Products

Alt Linux

Red Os

Tex Live

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26525.json · Exploit
• https://safe-surf.ru/specialists/bulletins-nkcki/718393 · Security Note
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136 · Patch
• https://moodle.org/mod/forum/discuss.php?d=466141 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-26525 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-26525 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-26525 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2025-26525 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02323 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-26525 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26525 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hmr-39vp-xfrr · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://twitter.com/Hossted_OSS/status/1899018636083319085 · Twitter Post