CVE-2025-21220
Published: 14 January 2025
Description
Microsoft Message Queuing Information Disclosure Vulnerability
Security Summary
CVE-2025-21220 is an information disclosure vulnerability in Microsoft Message Queuing (MSMQ), published on 2025-01-14. It stems from CWE-908 (use of uninitialized resource) and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low complexity, and no requirements for privileges or user interaction.
A remote, unauthenticated attacker can exploit this vulnerability over the network to disclose sensitive information from the affected MSMQ component. The attack requires no special privileges or user involvement, allowing an adversary to obtain high-impact confidential data without affecting integrity or availability.
For mitigation details, refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21220.
Details
- CWE(s)