Cyber Resilience

CVE-2025-52287

HighPublic PoCRCE

Published: 22 August 2025

Published
22 August 2025
Modified
12 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0023 46.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52287 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Elite Project Elite. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-52287 is a deserialization vulnerability (CWE-502) in the OperaMasks SDK ELite Script Engine version 0.5.0. Published on 2025-08-22, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting its high severity due to the potential for significant impact across confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, though it requires user interaction. Successful exploitation enables high-impact outcomes, including unauthorized access to sensitive data, modification of system resources, and disruption of services.

Researcher-provided references, including a GitHub gist and a related post by ChangeYourWay, offer further technical details on the issue. No official advisories or patches are specified in the available information.

EU & UK References

Vulnerability details

OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Deserialization flaw enables remote code execution via malicious input to the script engine; UI:R and network vector map to client-side exploitation (T1203) or public app exploitation (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-24162Shared CWE-502
CVE-2024-13163Shared CWE-502
CVE-2026-21226Shared CWE-502
CVE-2024-13770Shared CWE-502
CVE-2026-27303Shared CWE-502
CVE-2025-53586Shared CWE-502
CVE-2025-64353Shared CWE-502
CVE-2025-31047Shared CWE-502
CVE-2026-27096Shared CWE-502
CVE-2023-49886Shared CWE-502

Affected Assets

elite project
elite
0.5.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly addresses the deserialization vulnerability in OperaMasks SDK ELite Script Engine v0.5.0 by requiring timely identification, reporting, and remediation of the flaw through patching or replacement.

SI-10 Information Input Validation good match
prevent

Prevents exploitation of the deserialization vulnerability by validating and sanitizing untrusted inputs prior to deserialization processing.

SI-7 Software, Firmware, and Information Integrity partial match
preventdetect

Mitigates deserialization attacks by verifying the integrity of software components and serialized data to detect unauthorized modifications or tampering.

References