TI-2025-11678 Aliases CVE-2025-12742 GHSA-77vr-pq23-x7j9

Remote Code Execution in Looker via Teradata JDBC Driver

LOW 34CWE-78Published 2025-11-25 · Updated 2025-11-25

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A Looker user with a Developer role could cause Looker to execute a malicious command, due to insecure processing of Teradata driver parameters. Looker-hosted and Self-hosted were found to be vulnerable. This issue has already been mitigated for Looker-hosted instances. No user action is required for these. Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ : * 24.12.108+ * 24.18.200+ * 25.0.78+ * 25.6.65+ * 25.8.47+ * 25.12.10+ * 25.14+

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00253 16th percentileScored 2026-11-07

Fix Fixed Looker (Google Cloud): 24.12.108, 24.18.200, 25.0.78 +4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Google	Looker	before 24.12.108; before 24.18.200; before 25.0.78; before 25.6.65; before 25.8.47; before 25.12.10; before 25.14	24.12.108, 24.18.200, 25.0.78, 25.6.65, 25.8.47, 25.12.10, 25.14	Patch available	CNA
Google	Looker	before 24.12.108; before 24.18.200; before 25.0.78; before 25.6.65; before 25.8.47; before 25.12.10; before 25.14	24.12.108, 24.18.200, 25.0.78, 25.6.65, 25.8.47, 25.12.10, 25.14	Patch available	CNA

Looker VendorGoogle Affected before 24.12.108; before 24.18.200; before 25.0.78; before 25.6.65; before 25.8.47; before 25.12.10; before 25.14 Fixed in 24.12.108, 24.18.200, 25.0.78, 25.6.65, 25.8.47, 25.12.10, 25.14 Patch available CNA
Looker VendorGoogle Affected before 24.12.108; before 24.18.200; before 25.0.78; before 25.6.65; before 25.8.47; before 25.12.10; before 25.14 Fixed in 24.12.108, 24.18.200, 25.0.78, 25.6.65, 25.8.47, 25.12.10, 25.14 Patch available CNA

Remediation

Fix · CNA Looker (Google Cloud) Fixed in 24.12.108, 24.18.200, 25.0.78, 25.6.65, 25.8.47, 25.12.10, 25.14
Fix · CNA Looker (Google Cloud) Fixed in 24.12.108, 24.18.200, 25.0.78, 25.6.65, 25.8.47, 25.12.10, 25.14

Timeline

2026-10-02 Threatist record created from CVE-2025-12742
2026-10-03 Alias added: GHSA-77vr-pq23-x7j9

References

Other 1

https://cloud.google.com/support/bulletins#gcp-2025-052

TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6

See all 17247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences