CVE-2025-24035
Published: 11 March 2025
Description
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Security Summary
CVE-2025-24035 is a high-severity vulnerability (CVSS 8.1) involving sensitive data storage in improperly locked memory within Windows Remote Desktop Services. Published on March 11, 2025, it stems from CWE-591 and enables an unauthorized attacker to execute code over a network by exploiting this memory handling flaw.
An attacker with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary code execution on the targeted system.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24035 provides details on patches and mitigation guidance for affected Windows Remote Desktop Services instances.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables unauthenticated remote code execution in Windows Remote Desktop Services over a network, directly mapping to exploitation of public-facing applications and remote services for initial access.