Spotfire Code Execution Vulnerability (CVE-2025-3114) Advisory

Key Information Summary Vulnerability Overview Vulnerability Name: Spotfire Code Execution Vulnerability CVE ID: CVE-2025-3114 Release Date: April 8, 2025 CVSS v4.0 Base Score: 9.4 (Critical) Affected Product Versions Spotfire Enterprise Runtime for R: 6.1.4 and earlier Spotfire Statistics Services: 14.0.6 and earlier Spotfire Statistics Services: 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 Spotfire Enterprise Runtime for R - Server Edition: 117.6 and earlier Spotfire Enterprise Runtime for R - Server Edition: 118.0, 119.0, 120.0, 121.0, 121.1 Spotfire Analyst: 14.0.5 and earlier Spotfire Analyst: 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 Deployment Kit: For Spotfire Server 14.0.6 and earlier Deployment Kit: For Spotfire Server 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 Spotfire Desktop: 14.4.1 and earlier Spotfire for AWS Marketplace: 14.4.1 and earlier Vulnerability Description Malicious File Code Execution: Attackers can create special files containing embedded code, which may execute without proper security validation, leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions and execute untrusted code without appropriate controls. Remediation Upgrade to the following versions to resolve the issue: - Spotfire Enterprise Runtime for R: 6.1.5 or higher - Spotfire Statistics Services: 14.0.7 or higher - Spotfire Statistics Services: 14.4.2 or higher - Spotfire Enterprise Runtime for R - Server Edition: 117.7 or higher - Spotfire Enterprise Runtime for R - Server Edition: 122.2 or higher - Spotfire Analyst: 14.0.6 or higher - Spotfire Analyst: 14.4.2 or higher - Deployment Kit: Deployment Kit for Spotfire Server 14.0.7 or higher - Deployment Kit: Deployment Kit for Spotfire Server 14.4.2 or higher - Spotfire Desktop: 14.4.2 or higher - Spotfire for AWS Marketplace: 14.4.2 or higher

Goal Reached Thanks to every supporter — we hit 100%!

Spotfire Code Execution Vulnerability (CVE-2025-3114) Advisory