CVE-2025-21369
Published: 11 February 2025
Description
Microsoft Digest Authentication Remote Code Execution Vulnerability
Security Summary
CVE-2025-21369 is a Remote Code Execution vulnerability affecting Microsoft Digest Authentication. Published on 2025-02-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-122 (Heap-based Buffer Overflow), CWE-190 (Integer Overflow or Wraparound), and NVD-CWE-noinfo.
The vulnerability can be exploited by an attacker with low privileges (PR:L) over the network (AV:N) using low-complexity techniques that require no user interaction (UI:N). Successful exploitation enables remote code execution with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) in an unchanged security scope (S:U).
Microsoft's Security Update Guide provides details on affected software, exploitation status, and mitigation steps, including available patches, at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21369.
Details
- CWE(s)