CVE-2025-26496

Published Aug 22, 2025

Last updated 9 days ago

Salesforce Tableau

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-26496 is a type confusion vulnerability found in the file upload modules of Salesforce Tableau Server and Tableau Desktop on Windows and Linux. The vulnerability occurs when a resource is allocated or initialized as one type but later accessed as another, leading to logical errors. This type confusion can be exploited by attackers with file upload access to craft malicious files. By uploading these files, attackers can trigger type mismatches, potentially leading to the execution of arbitrary code within the Tableau application context. The vulnerability affects Tableau Server and Tableau Desktop versions before 2025.1.3, 2024.2.12, and 2023.3.19.

Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Source: security@salesforce.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.3
Impact score: 6
Exploitability score: 2.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@salesforce.com: CWE-843

Hype score: Not currently trending

References