Medium severity · published Jan 6, 2026
CVE-2025-14625
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
6.7
CVSS
0.1%
EPSS
No
On KEV
Description
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 19.1 through 24.1; Quartus Prime Lite: from 19.1 through 24.1.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QP
Quartus Prime Lite · Altera
19.1 through 24.1 · source: vendor
QP
Quartus Prime Standard · Altera
19.1 through 24.1 · source: vendor
QP
Quartus Prime · Intel
19.1 before 25.1; 19.1 before 25.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14625
community.altera.com
https://community.altera.com/kb/knowledge-base/how-to-mitigate-the-security-vulnerability-in-the-nios%C2%AE-ii-command-shell-utility/350185
Vendor Advisory
https://www.altera.com/security/security-advisory/asa-0005
More from Quartus Prime Lite
6.7
CVE-2025-14614
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
6.7
CVE-2025-14599
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory