CVE-2025-33076
Published: 23 July 2025
Summary
CVE-2025-33076 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Ibm Engineering Systems Design Rhapsody. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces bounds checking on inputs to prevent stack-based buffer overflows from improper input validation.
Implements memory protections such as stack canaries and address space layout randomization to block arbitrary code execution from buffer overflows.
Requires timely identification, reporting, and patching of flaws like CVE-2025-33076 to remediate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow with AV:N enables remote arbitrary code execution against the public-facing IBM Rhapsody application (T1190).
NVD Description
IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
Deeper analysisAI
IBM Engineering Systems Design Rhapsody versions 9.0.2, 10.0, and 10.0.1 are affected by CVE-2025-33076, a stack-based buffer overflow vulnerability caused by improper bounds checking (CWE-119). Published on 2025-07-23, the flaw carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local user could exploit the vulnerability by overflowing the buffer to execute arbitrary code on the system. The CVSS vector suggests exploitation is feasible over a network (AV:N) with low attack complexity (AC:L), requiring only low privileges (PR:L), no user interaction (UI:N), and unchanged scope (S:U), resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation details are available in the IBM security advisory at https://www.ibm.com/support/pages/node/7240368.
Details
- CWE(s)