CVE-2025-64186

CVE-2025-64186 describes a medium-severity vulnerability in the evervault-go SDK, affecting versions prior to 1.3.2, where incomplete attestation documents could pass validation, potentially leading clients to trust compromised enclave operators. The vulnerability has a CVSS score of 6.5 and is rated as medium risk, with an attack vector over the network requiring low privileges, and high impact on integrity. While primarily affecting applications checking only PCR8, its impact is mitigated when checking all PCR values. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.