CVE-2025-62458CWE-122

CVE-2025-62458

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

⚡ A heap-based buffer overflow in Windows Win32K means an authorized attacker could easily elevate their privileges — think of it as a guest sneaking into the VIP lounge when no one’s looking! 🎉 Picture a restaurant where waitstaff can only access the main dining area. Now, imagine one crafty waiter finds a way to sneak behind the scenes and enter the kitchen without permission — it shouldn't be allowed! That's precisely what's happening here with unauthorized access to sensitive system areas. If exploited, this vulnerability can lead to an attacker gaining higher privileges than intended, allowing them to install programs, view sensitive data, or even control the system entirely. This could be absolutely devastating, potentially compromising the entire environment.

Put simply

Picture a restaurant where waitstaff can only access the main dining area. Now, imagine one crafty waiter finds a way to sneak behind the scenes and enter the kitchen without permission — it shouldn't be allowed! That's precisely what's happening here with unauthorized access to sensitive system areas. This vulnerability in Windows Win32K occurs due to improper handling of memory allocations, leading to a heap-based buffer overflow that can be exploited by authorized users to execute code with elevated privileges.

What to do

If exploited, this vulnerability can lead to an attacker gaining higher privileges than intended, allowing them to install programs, view sensitive data, or even control the system entirely. This could be absolutely devastating, potentially compromising the entire environment. To remediate this issue, ensure that all systems are patched to the latest Windows updates where this vulnerability is addressed. Regularly review user permissions and implement least-privilege practices to reduce the attack surface. You've got this! With the right steps, you can lock this down and keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00657 · 50.8th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-12-09T23:15Z
Affected products (13)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.868810.0.14393.8688
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Win32k Elevation of Privilege Vulnerability
    cvelistv5