CVE-2025-70046

Critical

Published: 09 March 2026

Published

09 March 2026

Modified

13 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 18.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70046 is a critical-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Miazzy Oa-Font-Service. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-4 Information Flow Enforcement good match

prevent

Enforces approved information flow control policies between trusted and untrusted control spheres to prevent inclusion of unauthorized functionality as described in CWE-829.

SI-10 Information Input Validation good match

prevent

Validates all information inputs to block untrusted data that could trigger dynamic inclusion of functionality from untrusted sources in oa-front-service.

SI-3 Malicious Code Protection good match

preventdetect

Deploys malicious code protection at entry points to detect and eradicate any malicious functionality included from untrusted control spheres via this vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Critical remote unauthenticated vulnerability in a network-exposed service (CWE-829 inclusion of untrusted functionality) directly enables exploitation of public-facing applications for full system compromise.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue pertaining to CWE-829: Inclusion of Functionality from Untrusted Control Sphere was discovered in Miazzy oa-front-service master.

Deeper analysisAI

CVE-2025-70046 is a vulnerability classified under CWE-829, which involves the inclusion of functionality from an untrusted control sphere. It affects the master branch of Miazzy's oa-front-service, a component within the Miazzy project. The vulnerability was published on 2026-03-09T16:16:15.597 and carries a CVSS v3.1 base score of 9.8, indicating critical severity.

The vulnerability enables remote exploitation over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N), no user interaction (UI:N), and without changing scope (S:U). Attackers can achieve high impacts on confidentiality (C:H), integrity (I:H), and availability (A:H), potentially allowing full compromise of the affected service.

Advisories and additional details are available in the provided references, including a GitHub Gist at https://gist.github.com/zcxlighthouse/a29d9de46c4eac2de5c4d5a7b6c6c532, the main Miazzy repository at https://github.com/Miazzy, and the specific oa-front-service repository at https://github.com/Miazzy/oa-front-service. Practitioners should consult these for mitigation guidance and patches.