CVE-2025-21297

Published Jan 14, 2025

Last updated 5 months ago

Windows Remote Desktop

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-21297 is a remote code execution vulnerability affecting Windows Remote Desktop Services. It was discovered and disclosed in January 2025. The vulnerability can be exploited by an unauthenticated attacker sending a specially crafted RDP packet to a vulnerable system. Successful exploitation allows the attacker to execute arbitrary code on the target system. To successfully exploit this vulnerability, an attacker must win a race condition by precisely timing their actions, connecting to a system running the Remote Desktop Gateway role, then triggering the race condition to create a use-after-free scenario.

Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
Source: secure@microsoft.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-416
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA4426DD-B748-4CC4-AC68-88AD963E5F0C",
            "versionEndExcluding": "10.0.14393.7699"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8F604C79-6A12-44C9-B69D-A2E323641079",
            "versionEndExcluding": "10.0.17763.6775"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7B8C9C82-359E-4318-A10D-AA47CDFB38FE",
            "versionEndExcluding": "10.0.20348.3091"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E3E0C061-2DA7-4237-9607-F6792DC92DD3",
            "versionEndExcluding": "10.0.25398.1369"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "2CFD18D5-3C1F-4E3A-A143-EE3F1FFBB880",
            "versionEndExcluding": "10.0.26100.2894"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.