Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2025-62514

8.3 · HIGH
Published Jan 29, 2026 parsec.cloud CWE-327

Overview

CVE-2025-62514 is a high-severity vulnerability affecting parsec.cloud parsec. It was published on January 29, 2026 and has a CVSS 3.1 base score of 8.3 (HIGH).

This vulnerability has a CVSS 3.1 base score of 8.3, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.

Remediation

Check the references section for vendor advisories and patches from parsec.cloud. Update parsec to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor Product Versions Status
parsec.cloud parsec >= 3.0.0, < 3.6.0 Affected

References

GitHub github.com/Scille/parsec-cloud/blob/e7c5cdbc4234f606ccf3ab2be7e9edc22db16feb/libparsec/crates/crypto/src/rustcrypto/private.rs#L136-L138 GitHub github.com/Scille/parsec-cloud/commit/197bb6387b49fec872b5e4a04dcdb82b3d2995b2 GitHub github.com/Scille/parsec-cloud/security/advisories/GHSA-hrc9-gm58-pgj9 GitHub github.com/dalek-cryptography/curve25519-dalek/blob/8c53a8f10b146a2fd65069437e3576e49b390e7a/curve25519-dalek/src/montgomery.rs#L132-L146 GitHub github.com/dalek-cryptography/curve25519-dalek/blob/8c53a8f10b146a2fd65069437e3576e49b390e7a/x25519-dalek/src/x25519.rs#L364-L366

Frequently Asked Questions

What is CVE-2025-62514?

CVE-2025-62514 is a high-severity vulnerability affecting parsec.cloud parsec. It was published on January 29, 2026 and has a CVSS 3.1 base score of 8.3 (HIGH).

How severe is CVE-2025-62514?

This vulnerability has a CVSS 3.1 base score of 8.3, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2025-62514?

Check the references section for vendor advisories and patches from parsec.cloud. Update parsec to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2025-62514?

CyberStrike's AI-powered security agents can automatically detect CVE-2025-62514 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.
Browse by year 2026