RCE in Spotfire Deployment Kit Used In Server
CVE-2025-3114
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
EPSS exploit prediction
EPSS: 0.006 (46.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Spotfire Deployment Kit Used In Server — versions 14, 14.1.0, 14.2.0
- Spotfire Analyst — versions 14, 14.1.0, 14.2.0
- Spotfire Desktop — versions 14
- Spotfire Enterprise Runtime For R — versions 6
- Spotfire Enterprise Runtime For R - Server Edition — versions 1, 1.18.0, 1.19.0
- Spotfire For AWS Marketplace — versions 14
- Spotfire Statistics Services — versions 14, 14.1.0, 14.2.0