CVE-2025-0007

Published

24 November 2025

Modified

15 April 2026

CVSS Score v3.1 5.7

Click a component to see what it means

Raw vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0011 1th percentile

Risk Priority 39 floored blend · peak EPSS

Summary

CVE-2025-0007 is a medium-severity Improper Adherence to Coding Standards (CWE-710) vulnerability in Amd (inferred from references). Its CVSS base score is 5.7 (Medium).

Operationally, ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-15 (Development Process, Standards, and Tools) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-198995

Vulnerability Data

Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space, potentially compromising confidentiality, integrity, and/or availability.

CWE(s): CWE-710

Related Threats

CVEs Like This One

CVE-2023-30961Shared CWE-710

Affected Assets

Amd

—

inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-15 Development Process, Standards, and Tools good match

Requires developers to follow documented security and privacy standards as part of the development process, directly stopping improper adherence.

SA-11 Developer Testing and Evaluation partial match

Requires developer testing and evaluation that can identify deviations from coding standards after they occur.

SA-3 System Development Life Cycle partial match

Mandates use of an SDLC that incorporates security standards, reducing the chance that coding rules are ignored during development.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Integrating and monitoring secure SDLC practices directly enforces coding standards adherence while the control also addresses broader lifecycle activities.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match

prevents

Directly requires secure coding practices and standards.

A.8.29 Security testing in development and acceptance mostly match

finds

Testing can detect violations but does not prevent them.

A.5.36 Compliance with policies, rules and standards for information security partial match

finds

Enforces adherence to coding standards as part of policy compliance.

A.8.25 Secure development life cycle partial match

prevents

Secure SDLC mandates coding standards and rules.