CVE-2025-26383 MEDIUM

CVE-2025-26383

Vendor Johnson Controls
Product iSTAR Configuration Utility (ICU)
Weakness CWE-457
Published June 11, 2025
Last update June 11, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.

Key dates

02Disclosure timeline

June 11, 2025 CVE published
June 11, 2025 Record updated