Deserialization Vulnerability in Tencent TFace Product
CVE-2025-13709

7.8HIGH

Key Information:

Vendor

Tencent

Status
Tface
Vendor
CVE Published:
23 December 2025

What is CVE-2025-13709?

The vulnerability within Tencent TFace’s restore_checkpoint function stems from inadequate validation of incoming user data, enabling a potential remote code execution scenario. By manipulating this flaw, an attacker can execute arbitrary code within the context of the root user, given that the target either visits a malicious webpage or opens a compromised file. Mitigation measures should prioritize robust data validation to avert such exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

TFace Current

References

https://www.zerodayinitiative.com/advisories/ZDI-25-1036/
x_research-advisory
https://github.com/Tencent/TFace/commit/7b2eed297d43dcdd1...
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.