CVE-2025-58722CWE-122

Microsoft DWM Core Library Elevation of Privilege Vulnerability

High · published October 14, 2025

CVSS v3.1
7.8
EPSS
2%
Percentile
82.7
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can use a heap-based buffer overflow in Windows DWM to elevate their privileges locally — a sneaky way to gain access to more than they bargained for! 🔥 Think of this as a sneaky restaurant patron who finds a way to access the manager’s secret menu, suddenly able to order anything they want without being noticed. This is similar to how an attacker could exploit this vulnerability to unlock more powerful privileges on the system. If successfully exploited, an attacker could gain full control over the system, allowing them to install malicious software, modify system settings, or access sensitive data — all while covering their tracks. That’s a recipe for disaster!

Put simply

Think of this as a sneaky restaurant patron who finds a way to access the manager’s secret menu, suddenly able to order anything they want without being noticed. This is similar to how an attacker could exploit this vulnerability to unlock more powerful privileges on the system. This heap-based buffer overflow vulnerability allows an attacker with authorized access to manipulate memory, ultimately escalating their privileges to an administrative level within the system.

What to do

If successfully exploited, an attacker could gain full control over the system, allowing them to install malicious software, modify system settings, or access sensitive data — all while covering their tracks. That’s a recipe for disaster! To safeguard your systems, apply the latest Windows updates that address this vulnerability immediately. Additionally, review user permissions and ensure that only trusted accounts have authorized access, minimizing risks. 🛡️ You’ve got this! With these steps, you’ll bolster your defenses and keep your systems secure. Keep being the security hero! 🦸‍♂️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.02241 · 82.7th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Microsoft DWM Core Library Elevation of Privilege Vulnerability
    cvelistv5