CVE-2025-5469
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: Yandex N.V.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yandex | messenger | 2.245 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Uncontrolled Search Path Element issue in Yandex Messenger on MacOS, specifically affecting versions of Telemost before 2.245. It allows Search Order Hijacking, meaning an attacker could manipulate the order in which the system searches for executable files or libraries, potentially causing the application to load malicious code.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with limited privileges to hijack the search order for executable files or libraries, potentially leading to execution of malicious code with the privileges of the affected application. This could result in unauthorized actions or compromise of the system's integrity.