CVE-2025-0591

High

Published: 17 February 2025

Published

17 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0005 14.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0591 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Co (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 14.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-11 (Error Handling).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the out-of-bounds read vulnerability in CX-Programmer through timely patching as detailed in Omron advisory OMSR-2025-003, preventing exploitation for sensitive information disclosure or crashes.

SI-16 Memory Protection partial match

prevent

Provides system-level memory protections such as non-executable memory and address space randomization to mitigate unauthorized out-of-bounds reads in CX-Programmer.

SI-11 Error Handling partial match

prevent

Ensures error handling for out-of-bounds read conditions in CX-Programmer avoids disclosure of sensitive information in messages or logs and limits crash impacts.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

OOB read in desktop PLC software enables local code execution/info leak via crafted project file opened by user (T1204.002 Malicious File).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.

Deeper analysisAI

CVE-2025-0591 is an Out-of-bounds Read vulnerability (CWE-125) found in CX-Programmer. This issue affects the CX-Programmer software and was published on 2025-02-17 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Local attackers can exploit this vulnerability with low attack complexity and no privileges required, though user interaction is necessary. Exploitation may enable reading of sensitive information or cause an application crash, leading to high impacts on confidentiality, integrity, and availability.

Omron has issued security advisories OMSR-2025-003 detailing mitigation, available in English at https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf and in Japanese at https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf.