CVE-2025-59282CWE-362CWE-416

Internet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in Inbox COM Objects could let a crafty attacker execute code locally by jumping the queue! 😱 Think of it like a busy restaurant kitchen where two chefs are trying to grab the same pot at the same time, leading to chaotic results. If one chef gets ahead without proper coordination, they might end up serving a dish that wasn’t supposed to be on the menu! An attacker could potentially exploit this vulnerability to run arbitrary code on affected systems, leading to unauthorized access and control. This means sensitive information could be exposed or even critical system functions tampered with, leaving users vulnerable to further attacks!

Put simply

Think of it like a busy restaurant kitchen where two chefs are trying to grab the same pot at the same time, leading to chaotic results. If one chef gets ahead without proper coordination, they might end up serving a dish that wasn’t supposed to be on the menu! This issue arises from improper synchronization in concurrent execution using shared resources, allowing unauthorized execution of code by manipulating the timing of operations.

What to do

An attacker could potentially exploit this vulnerability to run arbitrary code on affected systems, leading to unauthorized access and control. This means sensitive information could be exposed or even critical system functions tampered with, leaving users vulnerable to further attacks! To safeguard against this, immediately patch the affected software to the latest version provided by the vendor. Additionally, review and strengthen synchronization mechanisms in your code to ensure proper access control to shared resources. You've got this! Stay proactive, and you'll keep your systems safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00605 · 48.3th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-416 · Use After Free
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Internet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution Vulnerability
    cvelistv5