CVE-2025-49708CWE-416

Microsoft Graphics Component Elevation of Privilege Vulnerability

Critical · published October 14, 2025

CVSS v3.1
9.9
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

🔥 A use-after-free vulnerability in Microsoft Graphics Component lets attackers elevate privileges over the network — a golden ticket for mischief! Think of it like a restaurant where a waiter keeps serving the same table even after they’ve checked out, letting anyone else at the door come in and claim their unfinished meal. Once the door is open, anything could happen! An attacker could waltz in and gain admin-level access, potentially compromising the entire system and stealing sensitive data. It’s absolutely devastating when the intruder has the illusion of trust!

Put simply

Think of it like a restaurant where a waiter keeps serving the same table even after they’ve checked out, letting anyone else at the door come in and claim their unfinished meal. Once the door is open, anything could happen! This vulnerability occurs when a program continues to use freed memory after its contents have been reclaimed, allowing an attacker with legitimate access to execute arbitrary code with elevated privileges.

What to do

An attacker could waltz in and gain admin-level access, potentially compromising the entire system and stealing sensitive data. It’s absolutely devastating when the intruder has the illusion of trust! Immediately apply the latest patches provided by Microsoft to close this security gap. Encourage users to limit network access to sensitive components and conduct a thorough audit of permissions. Best to act fast! You've got this! With the right steps, you can lock down your systems and protect your data. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01230 · 68.7th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft Graphics Component Elevation of Privilege Vulnerability
    cvelistv5