CVE-2025-40914

CRITICAL

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow ...

Affects 0 products across 1 vendor.

BCS7.11
CVSS 3.19.8
EPSS0.4%
Percentile36th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ SAGE Intelligence — CITED Relevance Research Team

Perl CryptX before version 0.087 contains a dependency on libtommath that is vulnerable to an integer overflow, which could lead to arbitrary code execution.

BSID: BS-2025-GLOBAL-259415-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-40914?
Perl CryptX before version 0.087 contains a dependency on libtommath that is vulnerable to an integer overflow, which could lead to arbitrary code execution.
What is the CVSS score for CVE-2025-40914?
CVE-2025-40914 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.4%.
Is CVE-2025-40914 actively exploited?
No confirmed active exploitation of CVE-2025-40914 as of 2026-05-30.
How do I remediate CVE-2025-40914?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-40914?
CVE-2025-40914 affects: Associated.
Vulnerability Details
CVE IDCVE-2025-40914
BSIDBS-2025-GLOBAL-259415-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-06-11
Last Modified2026-04-15
ICS Relevance0%
SourceNVD
Official Description

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could exploit the integer overflow vulnerability in the embedded libtommath library to execute arbitrary code on systems running Perl CryptX versions prior to 0.087. This could be achieved by crafting specific inputs that trigger the overflow condition.

Exploitation Likelihood: HIGH

Affected Products
VendorProductFixed Version
Associated — —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 409 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashd3def57831e7c6d6bd9c22ac4b3ace63875ced761474193bdfd0511519990ce4f022e21244dd7378f6666d49e582f9e462a1fe03f5f573c2a9e0635fe7b2de0a
Related CVEs affecting Associated
CVE-2024-2086 10.0 The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Ga... CVE-2026-5229 9.8 The Form Notify plugin for WordPress is vulnerable to Authentication Bypass i... CVE-2024-45337 9.1 Applications and libraries which misuse connection.serverAuthenticate (via ca... CVE-2025-10293 8.8 The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulner... CVE-2026-40581 8.1 ChurchCRM is an open-source church management system. In versions prior to 7....
View all Associated CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →