CVE-2025-20905

Summary

CVE-2025-20905 is a vulnerability affecting the mPOS TUI trustlet, a component in the SMR payment system, prior to its Feb-2025 Release 1. This issue permits local privileged attackers to perform out-of-bounds read and write operations, enabling them to access and manipulate unintended memory locations. This could potentially lead to data leakage or even system takeover, making it a significant security risk. The vulnerability was identified and reported to vendors, and users are strongly advised to update their systems to the latest release to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.