CVE-2025-10925: 
Linux Debian vulnerability analysis and mitigation

A security vulnerability (CVE-2025-2251) has been identified in WildFly and JBoss Enterprise Application Platform (EAP) affecting the Enterprise JavaBeans (EJB) remote invocation mechanism. The vulnerability was disclosed on April 7, 2025, and involves untrusted data deserialization handled by JBoss Marshalling (NVD).

The vulnerability stems from improper deserialization of untrusted data (CWE-502) in the EJB remote invocation mechanism. The CVSS v3.1 base score is 6.2 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H, indicating network accessibility with high attack complexity and high privileges required (NVD).

The vulnerability allows attackers to execute remote code without requiring authentication by sending specially crafted serialized objects. This can lead to unauthorized access with potential for high impact on system integrity and availability, while having a lower impact on confidentiality (NVD).

Red Hat has released security updates to address this vulnerability in JBoss Enterprise Application Platform 7.4.23. The fix is available through multiple security advisories including RHSA-2025:10925, which provides updated packages for affected components (Red Hat Advisory).