HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
CVE-2025-31978
MEDIUMNVD 4.34.6▲
EchelonGraph scoreMEDIUM confidence
Score 4.6 from GitHub Security Advisory published 2026-05-06. NVD baseline CVSS 4.6; sources differ by 0.0.
Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, nvd
4.3
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
- Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS: 0%CVSS: 4.3Exploit: NoneExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 4.3
- EG Score
- 4.6(medium)
- EG Risk
- —
- EPSS
- 3.6%
- KEV
- Not listed
Published
May 6, 2026
Last Modified
June 29, 2026
Advisory Details (1)
Auto-updated Jun 30, 2026No patch confirmed yet.
generic
Security Bulletin: Multiple security vulnerabilities affect HCL BigFix Service Management (SM) - Customer Support
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144Frequently asked(5)
What is CVE-2025-31978?
CVE-2025-31978 is a medium vulnerability published on May 6, 2026. HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when…
When was CVE-2025-31978 disclosed?
CVE-2025-31978 was first published in the National Vulnerability Database on May 6, 2026, with the most recent update on June 29, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2025-31978 actively exploited?
CVE-2025-31978 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 3.6% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2025-31978?
CVE-2025-31978 has a CVSS v3 base score of 4.3 (NVD). EchelonGraph synthesises NVD + CISA KEV + FIRST EPSS + GHSA into a combined EG score of 4.6.
How do I remediate CVE-2025-31978?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2025-31978, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2025-31978
Is Your Infrastructure Affected by CVE-2025-31978?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.