Forest Global Training Partners

Cyber Risks · Cisco Talos

DirectX, OpenFOAM, Libbiosig vulnerabilities

Summary: Cisco Talos disclosed a local privilege escalation vulnerability in the Microsoft DirectX End-User Runtime installation process, TALOS-2025-2293 (CVE-2025-68623), where a low-privileged user can replace an executable file during installation and may gain unintended elevation of privileges. Talos also disclosed an arbitrary code execution flaw in the Code Stream directive of OpenCFD OpenFOAM 2506 (TALOS-2025-2292, CVE-2025-61982) and three libbiosig flaws: an out-of-bounds read in ABF parsing (TALOS-2025-2323, CVE-2025-64736) that can leak information, plus heap-based buffer overflows in Intan CLP and Nicolet WFT parsing (TALOS-2026-2361, CVE-2026-22891 and TALOS-2026-2362, CVE-2026-20777) that can lead to arbitrary code execution.

Bottom line: The DirectX flaw is the one left unpatched by its vendor, and it sits in a runtime that ships pre-installed on Windows XP SP2 through Windows 10 and their Server equivalents, so a low-privileged user replacing a file during install is a path to elevation on a very wide install base.

Read the original at Cisco Talos ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2025-61982CVE-2025-64736CVE-2025-68623CVE-2026-20777CVE-2026-22891
Related