CVE-2025-26496

Executive Summary

CVE-2025-26496 is a Type Confusion vulnerability (CWE-843) affecting Salesforce Tableau Server and Tableau Desktop on Windows and Linux platforms. The flaw resides in the File Upload modules, allowing a local attacker to perform Local Code Inclusion by exploiting incompatible resource access. This can lead to arbitrary code execution with the privileges of the Tableau process. The vulnerability impacts versions prior to 2025.1.3, 2024.2.12, and 2023.3.19. No public proof-of-concept (PoC) or exploit code has been released, and the CVSS score is currently unassigned (0.0). The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for environments with untrusted local users.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Likely Low (L) – Type confusion can be triggered via crafted files.
• Privileges Required (PR): Low (L) – Attacker needs user-level access to upload files.
• User Interaction (UI): Required (R) – Victim must open or process the malicious file.
• Scope (S): Unchanged (U) – Exploitation stays within the Tableau process.
• Confidentiality (C): High (H) – Potential to read sensitive data.
• Integrity (I): High (H) – Potential to modify data or execute code.
• Availability (A): High (H) – Potential to crash or disrupt service.
• Threat Level: High – Local code inclusion can lead to full system compromise if combined with privilege escalation.

Deep Dive & Mechanics

The vulnerability is a Type Confusion in the File Upload modules of Tableau Server and Desktop. When processing uploaded files, the software incorrectly interprets the data type of a resource, leading to memory corruption. An attacker can craft a malicious file that, when uploaded and processed, causes the application to treat one object type as another (e.g., treating a string as a function pointer). This can result in arbitrary code execution within the context of the Tableau process.

Root Cause: The File Upload modules fail to validate the type of data being processed, allowing an attacker to supply a file that triggers a type mismatch during parsing or deserialization.

Attack Vector: Local – The attacker must have local access to the system (e.g., via a compromised user account or physical access) and be able to upload files to Tableau Server or Desktop.

Impact: Successful exploitation allows the attacker to execute arbitrary code, potentially leading to data exfiltration, lateral movement, or full system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No type check before casting
void process_uploaded_file(void *data) {
    // Assume data is a valid structure
    struct file_header *header = (struct file_header *)data;
    // Use header->type without validation
    if (header->type == TYPE_IMAGE) {
        // Process image
    }
}

Patched Code (Conceptual):

// Patched: Type validation before casting
void process_uploaded_file(void *data, size_t size) {
    // Validate size and type
    if (size < sizeof(struct file_header)) {
        return;
    }
    struct file_header *header = (struct file_header *)data;
    // Check magic bytes or type field
    if (header->magic != EXPECTED_MAGIC || header->type != TYPE_IMAGE) {
        return;
    }
    // Process image
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running vulnerable Tableau Server or Desktop.
• Ability to upload files (e.g., via Tableau’s file upload feature).

Exploitation Steps:

1. Craft Malicious File: Create a file that exploits the type confusion. For example, a specially crafted .twb or .hyper file that contains a type mismatch.
2. Upload File: Use Tableau’s file upload functionality (e.g., via the web interface or API) to upload the malicious file.
3. Trigger Processing: The file is processed by the vulnerable module, causing type confusion and arbitrary code execution.
4. Execute Payload: The attacker’s code runs with the privileges of the Tableau process.

Example Payload (Conceptual):

# Python script to generate a malicious file
import struct

# Craft a file that triggers type confusion
payload = b"\x00" * 100  # Placeholder
with open("malicious.twb", "wb") as f:
    f.write(payload)

Blue Team

Detection:

• Monitor file upload events in Tableau logs.
• Use file integrity monitoring to detect unexpected file modifications.
• Deploy endpoint detection and response (EDR) solutions to detect anomalous process behavior.

Mitigation:

• Apply the latest patches (versions 2025.1.3, 2024.2.12, or 2023.3.19).
• Restrict local access to Tableau systems.
• Implement application whitelisting to prevent execution of untrusted code.

Indicators of Compromise (IOCs)

• File Hashes: (None available publicly)
• Network Indicators: Unusual outbound connections from Tableau processes.
• Process Indicators: Tableau process spawning child processes (e.g., cmd.exe, powershell.exe).
• Registry Keys: (Windows) Modifications to Tableau-related registry keys.
• File System: Unexpected files in Tableau upload directories (e.g., C:\ProgramData\Tableau\Tableau Server\data\tabsvc\files).

Detection Engineering

YARA Rule

rule CVE_2025_26496_Type_Confusion {
    meta:
        description = "Detects malicious files exploiting CVE-2025-26496 in Tableau"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-26496"
    strings:
        $magic = { 54 41 42 4C } // "TABL" magic bytes for Tableau files
        $type_confusion = { 00 01 02 03 } // Example pattern
    condition:
        $magic at 0 and $type_confusion
}

Sigma Rule

title: CVE-2025-26496 Tableau Type Confusion Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2025-26496 via file upload
author: Valters IT
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11 (FileCreate)
        TargetFilename|contains: 'Tableau'
        TargetFilename|endswith: '.twb' or '.hyper'
    condition: selection
falsepositives:
    - Legitimate Tableau file uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26496 Tableau Type Confusion Exploitation"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"Tableau"; file_data; content:"|54 41 42 4C|"; distance:0; within:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Tableau: Update to versions 2025.1.3, 2024.2.12, or 2023.3.19.
2. Restrict Local Access: Limit user permissions on Tableau systems.
3. Monitor Logs: Enable detailed logging for file uploads and process execution.

Long-Term Measures:

• Implement input validation for all file uploads.
• Conduct regular security audits of Tableau configurations.
• Deploy application control solutions to prevent unauthorized code execution.

Workarounds:

• Disable file upload functionality if not required.
• Use network segmentation to isolate Tableau systems.

Valters IT
DevSecOps & Cyber Threat Intelligence