Security readout for executives and security teams
Plain-English summary
This vulnerability can let a remote attacker crash or disrupt OpenLink Virtuoso Open Source 7.2.11 by sending crafted SQL statements. The published impact is denial of service, not data theft or data modification. The main business risk is outage for systems depending on Virtuoso-backed data services.
Executive priority
Treat as a high-priority availability risk for exposed or business-critical Virtuoso services. Prioritize inventory and access restriction now, then patch or follow vendor guidance when a confirmed fix is available.
Technical view
CVE-2025-61018 affects the sqlo_place_dt_set component in openlink virtuoso-opensource v7.2.11. It is scored CVSS 3.1 7.5: network reachable, low complexity, no privileges, no user interaction, with high availability impact only. It is mapped to CWE-89, but the cited impact is DoS.
Likely exposure
Exposure is most likely where Virtuoso Open Source 7.2.11 is deployed and accepts SQL statements over reachable interfaces. The bundle’s affected-product metadata is incomplete, so teams should verify deployments directly rather than assuming package coverage.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector indicates the issue is remotely reachable without authentication, but sources only support denial-of-service impact.
Researcher notes
Sources identify the vulnerable component and DoS outcome but do not provide a confirmed patch, broad affected-version range, or exploitation evidence. Avoid generalizing beyond Virtuoso Open Source 7.2.11 unless vendor or distribution advisories expand affected versions.
Mitigation direction
- Inventory Virtuoso Open Source deployments and identify any version 7.2.11 instances.
- Check OpenLink and distribution guidance for a fixed version or official workaround.
- Restrict network access to SQL-capable Virtuoso interfaces to trusted sources.
- Apply vendor updates once an applicable fixed release is confirmed.
- Monitor for crashes or repeated SQL errors against Virtuoso services.
Validation and detection
- Confirm whether any deployed Virtuoso instance reports version 7.2.11.
- Identify which applications or users can submit SQL statements to Virtuoso.
- Review service logs for crashes, restarts, or abnormal SQL error bursts.
- Check Red Hat CVE and VEX data for distribution-specific affected status.
- Track the GitHub issue for maintainer clarification on fix availability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-61018 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-06-23T17:03:16.475Z: Reported to Red Hat.
- 2026-06-23T00:00:00.000Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openlink/virtuoso-opensource/issues/1224CVE reference, mitre
- https://access.redhat.com/security/cve/CVE-2025-61018CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2491820CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61018.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.