CVE-2025-5469 - Vulnerability Details - OpenCVE

Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Apple	Macos
Yandex	Messenger

No data.

No data.

References

Link	Providers
https://yandex.com/bugbounty/i/hall-of-fame-products

History

Wed, 10 Dec 2025 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Yandex Yandex messenger
Vendors & Products		Apple Apple macos Yandex Yandex messenger

Tue, 09 Dec 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 09 Dec 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245
Title		Dylib Hijacking in Yandex Messenger
Weaknesses		CWE-427
References		https://yandex.com/bugbounty/i/hall-of-fame-products
Metrics		cvssV4_0 `{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:A'}`

MITRE

Status: PUBLISHED

Assigner: yandex

Published: 2025-12-09T15:55:59.459Z

Updated: 2025-12-09T16:04:55.296Z

Reserved: 2025-06-02T12:52:09.646Z

Link: CVE-2025-5469

Vulnrichment

Updated: 2025-12-09T16:04:50.903Z

NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:59.507

Modified: 2025-12-09T18:36:53.557

Link: CVE-2025-5469

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5469", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "state": "PUBLISHED", "assignerShortName": "yandex", "dateReserved": "2025-06-02T12:52:09.646Z", "datePublished": "2025-12-09T15:55:59.459Z", "dateUpdated": "2025-12-09T16:04:55.296Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Messenger", "vendor": "Yandex", "versions": [{"lessThan": "2.245", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Egor Filatov, Positive Technologies"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.<p>This issue affects Telemost: before 2.245</p>"}], "value": "Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245"}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.3, "baseSeverity": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:A", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-12-09T15:55:59.459Z"}, "references": [{"url": "https://yandex.com/bugbounty/i/hall-of-fame-products"}], "source": {"discovery": "EXTERNAL"}, "title": "Dylib Hijacking in Yandex Messenger", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T16:04:09.847193Z", "id": "CVE-2025-5469", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T16:04:55.296Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5469", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-09T16:04:09.847193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T16:04:50.903Z"}}], "cna": {"title": "Dylib Hijacking in Yandex Messenger", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Egor Filatov, Positive Technologies"}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 7.3, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:A", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yandex", "product": "Messenger", "versions": [{"status": "affected", "version": "0", "lessThan": "2.245", "versionType": "custom"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "references": [{"url": "https://yandex.com/bugbounty/i/hall-of-fame-products"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245", "supportingMedia": [{"type": "text/html", "value": "Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.<p>This issue affects Telemost: before 2.245</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-12-09T15:55:59.459Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5469", "state": "PUBLISHED", "dateUpdated": "2025-12-09T16:04:55.296Z", "dateReserved": "2025-06-02T12:52:09.646Z", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "datePublished": "2025-12-09T15:55:59.459Z", "assignerShortName": "yandex"}, "dataVersion": "5.2"}