{"vulnerability": "cve-2025-6196", "sightings": [{"uuid": "5d7b0655-c2d6-4efc-aa63-e2a27c593ea7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6196", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lrt3ikmoll2k", "content": "", "creation_timestamp": "2025-06-17T18:05:54.886648Z"}, {"uuid": "708fc6b3-74ab-426d-907f-248cf2911035", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6196", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lt6aq7nf7k2i", "content": "", "creation_timestamp": "2025-07-04T22:04:11.387146Z"}, {"uuid": "b18334c7-c712-4ba8-bff4-857be6f26af9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2025-61960", "type": "seen", "source": "https://circl.lu/pub/tr-96/", "content": "", "creation_timestamp": "2025-10-16T09:05:24.176000Z"}, {"uuid": "dcd369ba-5dcb-4e52-b8c2-dace1ebd3c5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61962", "type": "seen", "source": "https://gist.github.com/Darkcrai86/a1855b7a0152cb0497dff9ba1a160fcf", "content": "", "creation_timestamp": "2025-10-26T17:32:22.000000Z"}, {"uuid": "0f93e776-cb75-4fd6-8961-f2b3b635cf2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61962", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3m2ewogxlau2o", "content": "", "creation_timestamp": "2025-10-04T15:49:12.031130Z"}, {"uuid": "a5963409-36dd-4429-ac7d-e8ec4e00183d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61962", "type": "seen", "source": "https://seclists.org/oss-sec/2025/q4/10", "content": "", "creation_timestamp": "2025-10-04T13:06:28.000000Z"}, {"uuid": "2c1e6f0c-e536-4f36-ab0d-e747baf44ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61962", "type": "seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3m3vgvei54l2w", "content": "", "creation_timestamp": "2025-10-23T22:47:11.793640Z"}, {"uuid": "c2a2b37f-4597-41fa-a4ca-e252ee87a4a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61962", "type": "seen", "source": "https://bsky.app/profile/bluesky.awakari.com/post/3m3vgvemlpl27", "content": "", "creation_timestamp": "2025-10-23T22:47:12.397937Z"}, {"uuid": "616a1607-74ef-4072-af68-7d56cc8e9d2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2025-61960", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/834a30cc-c06c-49b3-9157-eb77f711c73f", "content": "", "creation_timestamp": "2025-10-15T15:31:29.212143Z"}, {"uuid": "066df6c9-1303-4e01-bde3-545c09ee6eee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-6196", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/18596", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-6196\n\ud83d\udd25 CVSS Score: 5.5 (cvssV3_1, Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service.\n\ud83d\udccf Published: 2025-06-17T14:29:42.228Z\n\ud83d\udccf Modified: 2025-06-17T14:29:42.228Z\n\ud83d\udd17 References:\n1. https://access.redhat.com/security/cve/CVE-2025-6196\n2. https://bugzilla.redhat.com/show_bug.cgi?id=2373117\n3. https://gitlab.gnome.org/GNOME/libgepub/-/issues/18", "creation_timestamp": "2025-06-17T14:40:04.000000Z"}, {"uuid": "f3eea248-08aa-4359-8506-87852ae929f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-61969", "type": "seen", "source": "https://t.me/purp_sec/1418", "content": "\u0421\u0440\u0435\u0434\u0430, \u043c\u043e\u0438 \u0447\u0443\u0432\u0430\u043a\u0438! \u041f\u043e\u0440\u0430 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u043c\u0438 \u0448\u0442\u0443\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u0440\u0435\u0434\u0442\u0438\u043c\u0435\u0440\u043e\u0432.\n\n\u23fa AI System Intrusion Methodology \u2014 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043c\u0435\u0442\u043e\u0434\u043e\u043b\u043e\u0433\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 ML/AI-\u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u0436\u0438\u0437\u043d\u0435\u043d\u043d\u043e\u043c\u0443 \u0446\u0438\u043a\u043b\u0443 \u043c\u043e\u0434\u0435\u043b\u0438. \u0415\u0441\u0442\u044c data poisoning, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u043e\u0432 \u043c\u043e\u0434\u0435\u043b\u0435\u0439, LLM-\u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 (prompt injection, RAG poisoning), adversarial-\u043f\u0440\u0438\u043c\u0435\u0440\u044b \u0434\u043b\u044f vision-\u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 CI/CD \u0438 supply chain. \u0415\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432, \u043a\u043e\u0434\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0444\u0438\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f.\n\n\u23fa AMD uProf Exploitation \u2014 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0438 PoC \u0434\u043b\u044f CVE-2025-61969 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 AMDPowerProfiler.sys \u043f\u0430\u043a\u0435\u0442\u0430 AMD \u03bcProf. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0435\u0439 \u0438 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c Unicode-\u0441\u0442\u0440\u043e\u043a, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043e\u0448\u0438\u0431\u043a\u0430\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0443\u0442\u0435\u0439 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044f\u0445. \u0415\u0441\u0442\u044c PoC-\u043a\u043e\u0434 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 security advisory AMD.\n\n\u23fa AMSI.fail \u2014 \u043e\u043d\u043b\u0430\u0439\u043d-\u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440 \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 PowerShell-\u0441\u043d\u0438\u043f\u043f\u0435\u0442\u043e\u0432 \u0434\u043b\u044f bypass \u0438\u043b\u0438 disable AMSI \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 PowerShell. \u0420\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 memory patching amsi.dll (\u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c AmsiScanBuffer, \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 amsiContext/session, reflection-based \u043f\u043e\u0434\u0445\u043e\u0434\u044b \u0438 \u0434\u0440.), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0433\u043e\u0442\u043e\u0432\u044b\u0445 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 (ForceError, MattGRefl, RastaBuf \u0438 \u0434\u0440\u0443\u0433\u0438\u0435) \u0441 \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438, \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c\u0438 \u0434\u043b\u044f \u0431\u044b\u0441\u0442\u0440\u043e\u0433\u043e \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\n\n\u23fa AutoPtT \u2014 standalone open-source \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Pass-the-Ticket (PtT) \u0432 Kerberos-\u0441\u0440\u0435\u0434\u0435 Windows. \u041f\u043e\u0437\u0438\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0443\u0437\u043a\u043e\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u0430 Rubeus \u0438 Mimikatz \u0438\u043c\u0435\u043d\u043d\u043e \u0434\u043b\u044f PtT-\u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432. \u0420\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u044f\u0437\u044b\u043a\u0430\u0445 (C#, Rust, C++, Python, Crystal).\n\n\u23fa ClickOnceBlobber \u2014  Python-\u0442\u0443\u043b\u043a\u0438\u0442 \u0434\u043b\u044f \u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 .NET ClickOnce-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 dependency DLL \u043d\u0430 \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u044b\u0439 \u043f\u0435\u0439\u043b\u043e\u0430\u0434 (\u0432 \u0442.\u0447. SOCKS5/Beacon-\u043b\u043e\u0430\u0434\u0435\u0440\u044b), \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e \u0447\u0435\u0440\u0435\u0437 AppDomainManager \u0432 .exe.config, \u043f\u0430\u0442\u0447\u0438\u043d\u0433 \u0438 \u043f\u0435\u0440\u0435\u0441\u0447\u0435\u0442 SHA256-\u0445\u044d\u0448\u0435\u0439 \u0432 \u043c\u0430\u043d\u0438\u0444\u0435\u0441\u0442\u0430\u0445 (.application / .manifest / .deploy), \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438 \u043e\u0431\u043d\u0443\u043b\u0435\u043d\u0438\u044f publicKeyToken \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 signed .exe \u043d\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f.\n\n#red_team #offsec #\u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0435", "creation_timestamp": "2026-09-14T18:00:06.752849Z"}]}