CVE-2025-24067
Published: 11 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24067 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting the Microsoft Streaming Service. Published on 2025-03-11T17:16:29.477, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue enables an authorized attacker to elevate privileges locally through improper handling of heap memory.
A local attacker possessing low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction. Exploitation requires only local access (AV:L) and results in high impacts across confidentiality, integrity, and availability, allowing the attacker to elevate privileges and potentially gain broader system control.
Microsoft provides mitigation guidance in its Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24067.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Heap-based buffer overflow in Microsoft Streaming Service directly enables local privilege escalation by allowing low-privileged attackers to execute arbitrary code and gain elevated system privileges.