CVE-2025-64772VulnerabilityPublished 1 Dec 2025

CVE-2025-64772: Sony INZONE Hub · Uncontrolled Search Path Element

Affects Sony INZONE HubSource CVE Database V5

Not known to be exploited · CVSS 7.8 High.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 3.0 base score

7.8High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Sony Corporation INZONE Hub	Affected >=1.0.10.3 <=1.0.17.0	Fixed in–

AI-suggested

To mitigate CVE-2025-64772, European organizations should implement the following specific measures: 1) Restrict execution of the INZONE Hub installer to trusted administrators or controlled environments to minimize exposure to untrusted users. 2) Employ application whitelisting and code integrity policies to prevent unauthorized DLLs from loading during installation. 3) Monitor system and application logs for unusual DLL loading behavior or installer execution patterns indicative of exploitation attempts. 4) Educate users about the risks of running installers from untrusted sources and the importance of verifying software authenticity. 5) Isolate systems running INZONE Hub installers from critical network segments to limit potential lateral movement. 6) Prepare for patch deployment by inventorying affected versions and establishing rapid update procedures once Sony releases official patches. 7) Use endpoint detection and response (EDR) tools to detect suspicious activities related to DLL hijacking or privilege escalation. 8) Consider deploying sandbox environments for testing installers before production deployment. These targeted actions go beyond generic advice by focusing on controlling installer execution, monitoring DLL loading, and preparing for timely patching.

Description

The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

Impact

For European organizations, the impact of CVE-2025-64772 can be significant, especially in sectors relying on Sony INZONE Hub for device management, such as gaming, multimedia production, and professional audio-visual setups. Successful exploitation could allow attackers to execute arbitrary code locally, potentially leading to full system compromise, data breaches, or disruption of critical services. This risk is heightened in environments where users have administrative privileges or where the installer is run frequently. The vulnerability could be leveraged as an initial foothold in targeted attacks or as a vector for lateral movement within corporate networks. Given the high confidentiality, integrity, and availability impacts, organizations may face operational disruptions, loss of sensitive data, and reputational damage. The requirement for user interaction limits remote exploitation but does not eliminate risk, especially in scenarios involving social engineering or insider threats. The absence of known exploits currently provides a window for proactive defense, but the public disclosure increases the likelihood of future exploit development.

Summary

CVE-2025-64772 is a vulnerability identified in the installer of Sony Corporation's INZONE Hub software, specifically in versions 1.0.10.3 through 1.0.17.0. The root cause is an uncontrolled search path element during the DLL loading process. When the installer runs, it searches for required DLLs in directories that may be influenced by an attacker, potentially allowing malicious DLLs to be loaded instead of legitimate ones. This DLL hijacking can lead to arbitrary code execution with the privileges of the user running the installer. Since installers typically require user initiation, exploitation requires user interaction but does not require prior authentication or elevated privileges. The vulnerability impacts confidentiality, integrity, and availability because arbitrary code execution can lead to data theft, system compromise, or denial of service. The CVSS v3.0 base score is 7.8, reflecting high severity due to the combination of local attack vector, low attack complexity, no privileges required, and high impact on all security aspects. No known exploits have been reported yet, but the vulnerability is publicly disclosed and should be addressed promptly. The lack of patches at the time of disclosure means organizations must rely on interim mitigations until official fixes are released. This vulnerability is particularly relevant for environments where INZONE Hub is used to manage Sony peripherals, often in gaming or multimedia professional contexts.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Dec 2025, 01:00 UTC

Technical details

References

Community reviews

Related threats