---
id: CVE-2025-9612
title: >-
  An issue was discovered in the PCI Express (PCIe) Integrity and Data
  Encryption (IDE) specification, where insufficient guidance on Transaction
  Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to
  be replayed or …
summary: >-
  An issue was discovered in the PCI Express (PCIe) Integrity and Data
  Encryption (IDE) specification, where insufficient guidance on Transaction
  Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to
  be replayed or …
severity: medium
cvss: 5.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
vendor: pcisig
product: pci_express_integrity_and_data_encryption
affected:
  - pci_express_integrity_and_data_encryption
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-9612'
references:
  - url: 'https://pcisig.com/PCIeIDEStandardVulnerabilities'
    label: cret@cert.org
  - url: 'https://pcisig.com/specifications'
    label: cret@cert.org
  - url: 'https://kb.cert.org/vuls/id/404544'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00137
epssPercentile: 0.02763
ingestedAt: '2026-10-14T21:57:04.767Z'
---

## Overview

An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to be replayed or reordered without detection. This can enable local or physical attackers on the PCIe bus to violate data integrity protections.

## Affected

- `pci_express_integrity_and_data_encryption`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.