CVE-2025-14606 json
tiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserialization
published 2025-12-13 10 mo ago modified 2026-10-07 32 d ago also EUVD-2025-203263
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickle_convert.go of the component Pickle Decoding. The manipulation leads to deserialization. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/tiny-craft/tiny-rdm/issues/512 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| CNA | 3.0 | 5.0 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| CNA | 2.0 | 4.6 | AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR |
| CNA | 4.0 | 1.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 4.6 | AV:N/AC:H/Au:S/C:P/I:P/A:P |
Affected products
- tiny-rdm Tiny RDM
Classification
References
-
github.com
/tiny-craft/tiny-rdm/issues/512
exploit, issue-tracking
-
vuldb.com
/?id.336282
vdb-entry, technical-description
-
vuldb.com
/?ctiid.336282
signature, permissions-required
-
vuldb.com
/?submit.704138
third-party-advisory
Sources
- CVE List CVE-2025-14606
- NVD CVE-2025-14606
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.