CVE-2025-27249 identifies a denial of service vulnerability in Gaudi software versions before 1.21.0. The root cause is uncontrolled resource consumption within user applications operating at Ring 3 (user mode), which can be triggered by a system software adversary possessing authenticated local access. The attack complexity is low, and no user interaction is required, making exploitation feasible for authorized users with limited privileges. The vulnerability does not compromise confidentiality or integrity but can severely degrade system availability by exhausting resources, leading to service outages or system instability. The attack vector is local (AV:L), requiring authentication (PR:L), but no additional privileges or user interaction. The vulnerability was reserved in April 2025 and published in November 2025, with no known exploits in the wild to date. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N/VC:N/VI:N/VA:H) and score of 6.8 reflect a medium severity level focused on availability impact. The lack of special internal knowledge or user interaction lowers the barrier for exploitation by legitimate users who may act maliciously or inadvertently trigger the condition. Organizations running affected Gaudi software should assess their exposure, especially where local user authentication is possible and resource exhaustion could disrupt critical services.

For European organizations, this vulnerability poses a significant risk to system availability, particularly in environments where Gaudi software is integral to operations. Denial of service can lead to downtime, impacting business continuity, operational efficiency, and potentially causing financial losses. Critical sectors such as telecommunications, manufacturing, healthcare, and government services that rely on Gaudi software for user applications may experience service interruptions. Since the attack requires authenticated local access, insider threats or compromised user accounts could be exploited to trigger the DoS condition. The absence of confidentiality or integrity impact limits data breach risks, but availability degradation can indirectly affect service delivery and trust. Organizations with high availability requirements or those operating in regulated industries must prioritize mitigation to avoid compliance issues and reputational damage.

1. Upgrade Gaudi software to version 1.21.0 or later, where the vulnerability is addressed. 2. Implement strict access controls to limit authenticated local user access to trusted personnel only, reducing the risk of malicious exploitation. 3. Monitor resource usage patterns on systems running Gaudi software to detect abnormal consumption indicative of exploitation attempts. 4. Employ application whitelisting and endpoint protection to prevent unauthorized execution of potentially harmful user applications. 5. Conduct regular audits of user privileges and authentication mechanisms to minimize the attack surface. 6. Establish incident response procedures to quickly identify and mitigate denial of service events related to this vulnerability. 7. Where possible, isolate critical Gaudi software instances in segmented network zones to contain potential impacts. 8. Educate users with local access about the risks and encourage reporting of unusual system behavior.