CVE-2025-36581

Description

Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

CVSS v3.1 Score

3.8

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness Type (CWE)

CWE-788 CWE-788

CWE-119 Buffer Overflow

Affected Products

Vendor	Product	Versions
dell	poweredge_r6415_firmware	< 1.26.0
dell	poweredge_r6415	All
dell	poweredge_r7415_firmware	< 1.26.0
dell	poweredge_r7415	All
dell	poweredge_r7425_firmware	< 1.26.0
dell	poweredge_r7425	All

References

Advisories & Patches

https://www.dell.com/support/kbdoc/en-us/000356405/dsa-2025-299-security-update-for-dell-poweredge-server-bios-for-an-access-of-memory-location-after-end-of-buffer-vulnerability

Frequently Asked Questions

What is CVE-2025-36581? +

Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. It has a CVSS v3.1 base score of 3.8 (LOW).

How severe is CVE-2025-36581? +

CVE-2025-36581 has a CVSS v3.1 score of 3.8 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2025-36581? +

CVE-2025-36581 affects products from dell, specifically: poweredge_r6415, poweredge_r6415_firmware, poweredge_r7415, poweredge_r7415_firmware, poweredge_r7425, poweredge_r7425_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-36581? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2023-20585

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised …

CVE-2024-20330 8.6

A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) …

CVE-2024-20402 8.6

A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) …

CVE-2024-27828 7.8

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, …

CVE-2024-27829 7.8

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may …

CVE-2024-0074 7.1

NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end …