Cyber Posture

CVE-2025-21291

High

Published: 14 January 2025

Published
14 January 2025
Modified
24 January 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0165 82.1th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Windows Direct Show Remote Code Execution Vulnerability

Security Summary

CVE-2025-21291 is a remote code execution vulnerability in Windows DirectShow, a multimedia framework component within Microsoft Windows operating systems. Published on 2025-01-14T18:15:50.767, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-415 as well as NVD-CWE-noinfo.

The vulnerability can be exploited remotely over the network by unauthenticated attackers with low complexity, though it requires user interaction. Successful exploitation enables remote code execution, resulting in high impacts to confidentiality, integrity, and availability within the affected system's scope.

Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21291 provides details on mitigation and available patches for this vulnerability.

Details

CWE(s)
CWE-415NVD-CWE-noinfo

Affected Products

microsoft
windows 10 1809
≤ 10.0.17763.6775 · ≤ 10.0.17763.6775
microsoft
windows 10 21h2
≤ 10.0.19044.5371
microsoft
windows 10 22h2
≤ 10.0.19045.5371
microsoft
windows 11 22h2
≤ 10.0.22621.4751
microsoft
windows 11 23h2
≤ 10.0.22631.4751
microsoft
windows server 2019
≤ 10.0.17763.6775
microsoft
windows server 2022
≤ 10.0.20348.3091
microsoft
windows server 2022 23h2
≤ 10.0.25398.1369

References