Cyber Posture

CVE-2025-24064

High

Published: 11 March 2025

Published
11 March 2025
Modified
02 July 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0053 67.1th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-24064 is a use-after-free vulnerability (CWE-416) affecting the DNS Server component. Published on 2025-03-11, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute code over a network.

An unauthorized network attacker with no required privileges or user interaction can exploit this vulnerability. Due to the high attack complexity, successful exploitation allows remote code execution with high impacts on confidentiality, integrity, and availability.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24064 provides details on patches and mitigation guidance.

Details

CWE(s)
CWE-416

Affected Products

microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.7876
microsoft
windows server 2019
≤ 10.0.17763.7009
microsoft
windows server 2022
≤ 10.0.20348.3270 · 10.0.20348.3270 — 10.0.20348.3328
microsoft
windows server 2022 23h2
≤ 10.0.25398.1486
microsoft
windows server 2025
≤ 10.0.26100.3403 · 10.0.26100.3403 — 10.0.26100.3476

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The use-after-free vulnerability in the DNS Server component allows unauthenticated remote code execution over the network (AV:N), directly enabling T1190 (Exploit Public-Facing Application) as the primary attack vector for initial access and code execution on the exposed service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References