CVE-2025-29807
Published: 21 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-29807 is a deserialization of untrusted data vulnerability affecting Microsoft Dataverse. Published on 2025-03-21, it is associated with CWE-94 (code injection) and CWE-502 (deserialization of untrusted data), earning a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation allows remote code execution, resulting in high impacts to confidentiality and integrity (C:H/I:H), with no impact to availability (A:N) but a changed scope (S:C).
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29807 provides details on mitigation and patches.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The deserialization vulnerability in Microsoft Dataverse allows a low-privileged authenticated attacker to achieve remote code execution (CWE-94/502), directly mapping to exploitation for privilege escalation from low to high impact.