CVE-2025-26383

Published: Jun 11, 2025Modified: Jun 17, 2026Deferred

6.3

Vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: productsecurity@jci.com (Secondary)

Description

The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.

Related CWEs

CWE-457

Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

References (2)

https://www.cisa.gov/news-events/ics-advisories/icsa-25-146-01

Source: productsecurity@jci.com

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Source: productsecurity@jci.com

Timeline

No history available yet.