« Volver al listado

CVE-2025-32776

Estado: AplazadaMedia (5.5)—

OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the `matrix_custom_frame` file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openrazer — OpenrazerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32776",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32776",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-15T17:51:23.419369Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "openrazer",
          "product": "openrazer",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.10.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-15T17:15:49.730",
  "references": [
    {
      "url": "https://github.com/openrazer/openrazer/commit/57610511d2548eda66999eaed5aa4517e89d6d39",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openrazer/openrazer/commit/d869abd20995b4931795e1cde54d4ac84d9ca62f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openrazer/openrazer/issues/2433",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openrazer/openrazer/security/advisories/GHSA-835j-6976-46jx",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00032.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the `matrix_custom_frame` file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2."
    },
    {
      "lang": "es",
      "value": "OpenRazer es un controlador de código abierto y un daemon de espacio de usuario para controlar la iluminación de dispositivos Razer y otras funciones en GNU/Linux. Al escribir datos especialmente manipulados en el archivo `matrix_custom_frame`, un atacante puede provocar que el controlador de kernel personalizado lea más bytes de los que proporciona el espacio de usuario. Estos datos se escribirán en los argumentos RGB que se enviarán al dispositivo USB. Este problema se ha corregido en la versión 3.10.2."
    }
  ],
  "lastModified": "2026-06-17T09:12:33.283",
  "sourceIdentifier": "security-advisories@github.com"
}