CVE-2025-3114 CRITICAL

CVE-2025-3114: Spotfire Code Execution Vulnerability

Vendor Spotfire
Product Spotfire Enterprise Runtime for R
Published April 9, 2025
Last update April 15, 2025

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.

Key dates

02Disclosure timeline

April 9, 2025 CVE published
April 15, 2025 Record updated