CVE-2025-65100

MediumCVSS 6.9

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb.

Risk Assessment

This may result in missing critical security updates in generated systems, increasing exposure to known vulnerabilities.

Recommendation

Update Isar to a version containing the fix (commit 738bcbb) or later.

Other vulnerabilities in Isar

CVE-2026-55222Medium
Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to deploy local keys, so the directory is owned by the calling user instead of root. If the calling user's id matches an unprivileged user inside the image, that user can alter existing keys and deploy new ones, silently breaking apt repo integrity protection.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS