CVE-2025-35966

A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201	Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2201
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bloomberg:comdb2:8.1:*:*:*:*:*:*:*

History

03 Nov 2025, 20:18

Type	Values Removed	Values Added
References		() https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2201 -
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201 - Third Party Advisory, Exploit~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201 - Exploit, Third Party Advisory

Information

Published : 2025-07-22 16:15

Updated : 2025-11-03 20:18

NVD link : CVE-2025-35966

Mitre link : CVE-2025-35966

CVE.ORG link : CVE-2025-35966

JSON object : View

Products Affected

bloomberg

comdb2

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-35966", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-07-22T16:15:26.913", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2201", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de desreferencia de puntero nulo en la gesti\u00f3n de mensajes del b\u00fafer de protocolo CDB2SQLQUERY de Bloomberg Comdb2 8.1. Un mensaje de b\u00fafer de protocolo especialmente manipulado puede provocar una denegaci\u00f3n de servicio. Un atacante puede simplemente conectarse a una instancia de base de datos a trav\u00e9s de TCP y enviar el mensaje manipulado para activar esta vulnerabilidad."}], "lastModified": "2025-11-03T20:18:30.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bloomberg:comdb2:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B7BA78E-2D63-4122-BD8D-B3BBCD719556"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}