PT-2026-5304 · Unknown+1 · Libparsec Crypto+1

Published 2026-01-29 · Updated 2026-03-02 · CVE-2025-62514

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Parsec versions prior to 3.6.0

Description Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, the libparsec crypto component does not check for weak order points of Curve25519 when compiled with its RustCrypto backend. This allows an attacker in a man-in-the-middle position to provide weak order points to both parties during the Diffie-Hellman exchange. This can result in both parties obtaining the same shared key, enabling a successful SAS code exchange and misleading both parties into believing no MITM attack has occurred. Only Parsec web is impacted. The vulnerable component is libparsec crypto.

Recommendations Update to Parsec version 3.6.0 or later.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-1240

CWE-327

Related Identifiers

CVE-2025-62514

GHSA-HRC9-GM58-PGJ9

Affected Products

Parsec

Libparsec Crypto

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62514.json · Exploit
• https://github.com/dalek-cryptography/curve25519-dalek/blob/8c53a8f10b146a2fd65069437e3576e49b390e7a/x25519-dalek/src/x25519.rs#L364-L366 · Patch
• https://github.com/dalek-cryptography/curve25519-dalek/blob/8c53a8f10b146a2fd65069437e3576e49b390e7a/curve25519-dalek/src/montgomery.rs#L132-L146 · Patch
• https://github.com/Scille/parsec-cloud/commit/197bb6387b49fec872b5e4a04dcdb82b3d2995b2 · Patch
• https://github.com/Scille/parsec-cloud/security/advisories/GHSA-hrc9-gm58-pgj9 · Vendor Advisory
• https://github.com/Scille/parsec-cloud/blob/e7c5cdbc4234f606ccf3ab2be7e9edc22db16feb/libparsec/crates/crypto/src/rustcrypto/private.rs#L136-L138 · Patch
• https://osv.dev/vulnerability/CVE-2025-62514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62514 · Security Note
• https://twitter.com/pulsepatchio/status/2017608601830064192 · Twitter Post
• https://t.me/CVEtracker/43256 · Telegram Post
• https://twitter.com/TheHackerWire/status/2016919216449081491 · Twitter Post
• https://t.me/cveNotify/153792 · Telegram Post