CVE-2025-7403
Zephyrproject Zephyr ≤ 4.1.0
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HSummary
CVE-2025-7403 is a high-severity Write-what-where Condition (CWE-123) vulnerability in Zephyrproject Zephyr. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30240
Vulnerability Data
Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free memory corruption with attacker-controlled write enables local privilege escalation via exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces memory protection mechanisms that block unauthorized writes, mitigating the attacker-controlled write-what-where primitive from the use-after-free.
Process isolation confines the effects of memory corruption in bt_conn_tx_processor, preventing the 4-byte write from affecting other security domains or kernel structures.
Integrity verification of executing code and data can detect the precise memory corruption introduced by the flawed tx processor before further exploitation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent arbitrary write conditions via safe coding, bounds checking, and memory-safe constructs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect write-what-where conditions before deployment.
Secure development lifecycle practices directly reduce the likelihood of write-what-where flaws such as buffer overflows.
Application security requirements can mandate input validation and bounds checking that mitigate arbitrary write conditions.
Secure architecture and engineering principles discourage unsafe memory handling that leads to write-what-where vulnerabilities.
Secure coding standards explicitly forbid unsafe buffer operations that enable arbitrary memory writes.
Change management processes help ensure security fixes for such weaknesses are properly deployed.