CVE-2025-70330

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-70330", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-05T16:14:31.870Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-03-11T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T16:14:31.870Z"}, "descriptions": [{"lang": "en", "value": "Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. By modifying specific fields at precise offsets within an otherwise valid .EGP file, an attacker can trigger an out-of-bounds memory read during parsing. This results in an unhandled access violation and application crash, leading to a local denial-of-service condition when the crafted file is opened by a user."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/TheMalwareGuardian/CVE-2025-70330"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:00:35.859052Z", "id": "CVE-2025-70330", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:01:13.165Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-70330", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:00:35.859052Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:58:42.444Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/TheMalwareGuardian/CVE-2025-70330"}], "descriptions": [{"lang": "en", "value": "Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. By modifying specific fields at precise offsets within an otherwise valid .EGP file, an attacker can trigger an out-of-bounds memory read during parsing. This results in an unhandled access violation and application crash, leading to a local denial-of-service condition when the crafted file is opened by a user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T16:14:31.870Z"}}}, "cveMetadata": {"cveId": "CVE-2025-70330", "state": "PUBLISHED", "dateUpdated": "2026-07-05T16:14:31.870Z", "dateReserved": "2026-01-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-11T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in the handling of proprietary .EGP gradebook files. By modifying specific fields at precise offsets within an otherwise valid .EGP file, an attacker can trigger an out-of-bounds memory read during parsing. This results in an unhandled access violation and application crash, leading to a local denial-of-service condition when the crafted file is opened by a user."}, {"lang": "es", "value": "Easy Grade Pro 4.1.0.2 contiene una falla l\u00f3gica en el an\u00e1lisis de archivos en el manejo de archivos de libro de calificaciones .EGP propietarios. Al modificar campos espec\u00edficos en desplazamientos precisos dentro de un archivo .EGP por lo dem\u00e1s v\u00e1lido, un atacante puede desencadenar una lectura de memoria fuera de l\u00edmites durante el an\u00e1lisis. Esto resulta en una violaci\u00f3n de acceso no manejada y un bloqueo de la aplicaci\u00f3n, lo que lleva a una condici\u00f3n de denegaci\u00f3n de servicio local cuando el archivo manipulado es abierto por un usuario."}], "id": "CVE-2025-70330", "lastModified": "2026-07-05T17:17:27.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70330", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:00:35.859052Z", "version": "2.0.3"}}]}, "published": "2026-03-11T15:16:23.493", "references": [{"source": "cve@mitre.org", "url": "https://github.com/TheMalwareGuardian/CVE-2025-70330"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1.0.2"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "grade_pro", "vendor": "easy"}], "analysis": {"en": {"generated_at": "2026-03-17T15:00:40.665138+00:00", "value": {"mitigation_remediation": ["Verify whether the vendor has released a patch or update for Easy Grade Pro 4.1.0.2", "Apply the vendor\u2019s update as soon as it is available", "Disable automatic opening of unknown .EGP files or restrict the application to a limited user account", "Scan all .EGP files with an up\u2011to\u2011date antivirus or sandbox solution before opening", "Monitor application logs for unexpected crashes and report any incidents to the vendor"], "summary": {"action": "Assess Impact", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is Easy Grade Pro version 4.1.0.2. No other vendors, products, or versions are listed as impacted.", "description_and_impact": "Easy Grade Pro 4.1.0.2 contains a flaw in the parsing of proprietary .EGP gradebook files. By inserting crafted data at specific offsets, an attacker can trigger an out\u2011of\u2011bounds read during parsing, resulting in an unhandled access violation and application crash. This flaw is a buffer read after the end of the allocated memory (CWE\u2011125) and can cause a local denial\u2011of\u2011service condition for the user who opens the compromised file.", "risk_and_exploitability": "The CVSS score is 3.3, indicating low overall severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires a local user to open a malicious .EGP file, so exploitation is limited to environments where users have the possibility to execute benign software. The flaw only leads to denial of service and does not provide a remote code execution or privilege escalation path."}}}}, "created": "2026-03-12T10:06:44.709855+00:00", "updated": "2026-03-20T14:33:42.165744+00:00", "vendors": ["easy", "easy$PRODUCT$grade_pro"]}