cve 2025 4435

CVE-2025-4435 is a security vulnerability related to a tarfile library that may affect Microsoft's Azure Linux distribution. Microsoft's public attestation identifies Azure Linux as a product that includes the vulnerable open-source library, but this is a scope declaration of inventory work, not proof that it is the only affected Microsoft product. Microsoft has stated it will update the CVE mapping if additional products are found to ship the affected component. Customers should treat the Azure Linux attestation as a starting point and monitor for further updates from Microsoft regarding the scope of this vulnerability.