Cyber Posture

CVE-2025-21358

High

Published: 11 February 2025

Published
11 February 2025
Modified
28 February 2025
KEV Added
—
Patch
—
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0008 23.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Windows Core Messaging Elevation of Privileges Vulnerability

Security Summary

CVE-2025-21358 is a Windows Core Messaging Elevation of Privileges Vulnerability, published on 2025-02-11. It affects the Core Messaging component in Windows operating systems and is associated with CWE-822 (Untrusted Pointer Dereference) along with NVD-CWE-noinfo. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with local access.

A local attacker with low privileges (PR:L) can exploit this vulnerability through low-complexity attacks requiring no user interaction (UI:N). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), allowing the attacker to elevate privileges, potentially gaining full system control within the unchanged security scope (S:U).

Microsoft's Security Response Center provides update guidance and mitigation details for CVE-2025-21358 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21358.

Details

CWE(s)
CWE-822NVD-CWE-noinfo

Affected Products

microsoft
windows 10 1507
≤ 10.0.10240.20915 · ≤ 10.0.10240.20915
microsoft
windows 10 1607
≤ 10.0.14393.7785 · ≤ 10.0.14393.7785
microsoft
windows 10 1809
≤ 10.0.17763.6893 · ≤ 10.0.17763.6893
microsoft
windows 10 21h2
≤ 10.0.19044.5487
microsoft
windows 10 22h2
≤ 10.0.19045.5487
microsoft
windows 11 22h2
≤ 10.0.22621.4890
microsoft
windows 11 23h2
≤ 10.0.22631.4890
microsoft
windows 11 24h2
≤ 10.0.26100.3194
microsoft
windows server 2016
≤ 10.0.14393.7785
microsoft
windows server 2019
≤ 10.0.17763.6893
+3 more product configuration(s) — see NVD for full list

References