CVE-2025-64656CWE-125

CVE-2025-64656

Critical · published November 26, 2025

CVSS v3.1
9.4
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

🔥 An out-of-bounds read in Application Gateway could let unauthorized attackers elevate their privileges like sneaky squirrels finding a way into your well-stocked attic! Imagine your home security system is tricked into thinking a squirrel is a trusted resident. This vulnerability allows attackers to exploit misplaced trust and gain access to areas they shouldn't—elevating their privileges and snooping around your sensitive data as if they were on the guest list! The consequences could be absolutely devastating—once inside, attackers could manipulate user privileges, access confidential data, or even take control of the entire network! This isn't just a minor breach; it’s an invitation for chaos and loss of control over your critical systems. This is a big deal!

Put simply

Imagine your home security system is tricked into thinking a squirrel is a trusted resident. This vulnerability allows attackers to exploit misplaced trust and gain access to areas they shouldn't—elevating their privileges and snooping around your sensitive data as if they were on the guest list! This vulnerability arises from improper handling of memory within Application Gateway, allowing unauthorized users to perform out-of-bounds reads. When exploited, this flaw can lead to privilege escalation, giving attackers more access than intended.

What to do

The consequences could be absolutely devastating—once inside, attackers could manipulate user privileges, access confidential data, or even take control of the entire network! This isn't just a minor breach; it’s an invitation for chaos and loss of control over your critical systems. This is a big deal! To mitigate this, patch your Application Gateway to the latest version as soon as possible. Regularly audit user permissions to ensure no unauthorized access has slipped through, and enhance your monitoring to catch any suspicious activity early. Don't wait to secure your systems! You've got this! Follow these steps, and you'll have your defenses up in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-11-26T06:16Z
Affected products (1)
ProductVersionsFixed in
microsoft/azure_application_gatewayall versions—
References (1)
EPSS history
Timeline
  • 26 NOV 00:20Z
    Azure Application Gateway Elevation of Privilege Vulnerability
    cvelistv5