CVE Details
Basic Information
| Title | CVE-2025-35966 |
|---|---|
| Type | cve |
| Published | 2025-07-22T15:26:28.550Z |
| Modified | 2025-07-22T15:26:28.550Z |
Product Information
| Vendor | Bloomberg |
|---|---|
| Product | Comdb2 |
| Version | 8.1 |
CVSS Information
| Base Score | 7.5 (HIGH) |
|---|---|
| Attack Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected Products
- Bloomberg Comdb2 8.1
Additional Information
| CWE List | CWE-476 |
|---|---|
| Source | talos |
Description
A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability.