- Description
- Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- windows_10_1507, windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 5.9
- Exploitability score
- 1.6
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- secure@microsoft.com
- CWE-367
- Hype score
- Not currently trending
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://t.co/HlpFwIFJ70 #cyber #threathunting #infosec
@blueteamsec1
22 Mar 2026
782 Impressions
4 Retweets
5 Likes
2 Bookmarks
0 Replies
0 Quotes
EventLogin CVE-2025-29969 A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes Source: https://t.co/d8OwtV3Z8m Research: https://t.co/IwYjeBzmpr h
@HackingTeam77
17 Mar 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
EventLogin — CVE-2025-29969 A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes 🔗 Source: https://t.co/Zyd4CI6RvG 🔗 Research:
@ksg93rd
16 Mar 2026
1063 Impressions
4 Retweets
23 Likes
9 Bookmarks
0 Replies
0 Quotes
SafeBreach Labs found CVE-2025-29969. This high-severity heap-based buffer overflow allows unauthenticated RCE in Trend Micro Apex One and Worry-Free Business Security products. Patches have been released. PS: Visit olivermaicher[.]eu
@cybrmaker
1 Mar 2026
146 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SafeBreach discovered CVE-2025-29969 in Microsoft Azure Site Recovery agent. This allows Local Privilege Escalation by loading a malicious DLL with SYSTEM privileges. Microsoft patched the flaw in June 2024. Update your ASR agents.
@cybrmaker
27 Feb 2026
33 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2018-17144 2 - CVE-2025-29969 3 - CVE-2025-11730 4 - CVE-2026-21518 5 - CVE-2025-60021 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
23 Feb 2026
133 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969): https://t.co/XwGKrXG07J #cybersecurity #informationsecurity #infosec #vulnerability #cve #windows #exploitation https://t.co/fxXCPUPzkU
@blackstormsecbr
21 Feb 2026
111 Impressions
2 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29969 EventLogin A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes https://t.co/otpejBHrCl #dfir #blueteam #redteam #pentesting #cve
@co11ateral
21 Feb 2026
1871 Impressions
15 Retweets
39 Likes
21 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://t.co/P2dLQGXZXm
@Dinosn
20 Feb 2026
824 Impressions
0 Retweets
9 Likes
3 Bookmarks
0 Replies
0 Quotes
Discovery & Analysis of CVE-2025-29969 https://t.co/nN8cpjcss8
@_r_netsec
20 Feb 2026
517 Impressions
2 Retweets
6 Likes
1 Bookmark
0 Replies
0 Quotes
Discovery & Analysis of CVE-2025-29969 https://t.co/0SOqskqryK https://t.co/hNltLVY1wW
@secharvesterx
20 Feb 2026
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://t.co/sShgXMlb08 https://t.co/Jd2d8kP1e3
@warthogtk
19 Feb 2026
60 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
New blog & exploit about CVE-2025-29969 - RCE by Yarin Aharoni @safebreach Labs. Findings allow: ---- * Checking arbitrary paths existence (unfixed!). * Writing files remotely (RCE). ---- On ALL Windows & Windows Server computers in the domain! Repo - https://t.co/Ygs0t7
@oryair1999
19 Feb 2026
4125 Impressions
26 Retweets
66 Likes
34 Bookmarks
1 Reply
0 Quotes
New blog & exploit about CVE-2025-29969 - RCE by Yarin Aharoni @safebreach Labs. Findings allow: ---- * Checking arbitrary paths existence (unfixed!). * Writing files remotely (RCE). ---- On ALL Windows & Windows Server computers in the domain! Exploit - https://t.co/Ygs
@oryair1999
19 Feb 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29969 is an RPC #RemoteCodeExecution vulnerability, base score 7.5. Exploits a time-of-check time-of-use & affects Windows vers 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1, 2008 SP2; Win 11 22H2/23H2/24H2, Win 10 1607/1809/21H2/22H2. https://t.co/jrd1brZLjs
@ZeroNLabs
15 May 2025
285 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
1 Quote
🛡️ Windows just revealed a critical vulnerability—CVE-2025-29969—that’s like a race in reverse! Don’t let those pesky RPC conditions trip you up. Time to patch up your defenses! #WindowsForum #CyberSecurity #CVE2025 https://t.co/MBbTQeW9Ir
@windowsforum
14 May 2025
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29969 Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network. https://t.co/9AgHdd397q
@CVEnew
13 May 2025
226 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "0B6B5CAA-8A5A-4676-BC01-CD97BDCE5763",
"versionEndExcluding": "10.0.10240.21014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "4E77111E-B41A-4E88-AC0B-2EBEC9E042FF",
"versionEndExcluding": "10.0.10240.21014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "A725E104-8456-4AE8-9A9D-10127FC36BDE",
"versionEndExcluding": "10.0.14393.8066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "4720EC2C-1371-4D1F-80E6-7804D079C183",
"versionEndExcluding": "10.0.14393.8066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "63199B82-79B6-461A-AC6D-CD1EE5EBCC80",
"versionEndExcluding": "10.0.17763.7314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "C7D99F6B-B97B-4010-AA5C-84E9FE50D860",
"versionEndExcluding": "10.0.17763.7314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "8047D88E-3BAD-4DCE-A1CD-68BEBEE06D50",
"versionEndExcluding": "10.0.19044.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "66B77F75-39F2-46EE-BC6F-06650808568E",
"versionEndExcluding": "10.0.19044.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "63101BFA-2F60-49BD-8E03-6F13FA9A106D",
"versionEndExcluding": "10.0.19044.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "26BA0DF8-5B45-4B1D-A5F2-3D3B7A60AF90",
"versionEndExcluding": "10.0.19045.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "404F532F-861B-42E0-B31D-325E5CFEE8EC",
"versionEndExcluding": "10.0.19045.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "2A951F53-2D80-44A8-ADE4-9E26702BB76E",
"versionEndExcluding": "10.0.19045.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "CA321DC2-D196-4C81-87E8-B1A240A75CB8",
"versionEndExcluding": "10.0.22621.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "CA476FFD-741C-4534-AA84-BA3511AE1413",
"versionEndExcluding": "10.0.22621.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "28D1BDF2-8DF7-48DF-BBF7-E5DE3EF243D1",
"versionEndExcluding": "10.0.22631.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "3F66E394-51B6-48B2-AFF6-A45007E654AD",
"versionEndExcluding": "10.0.22631.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "4448191F-2152-4E7F-8D4A-4EE7ED6657D6",
"versionEndExcluding": "10.0.26100.4061",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "7CE8E58A-59AA-4649-8C0F-0DB11A1D1936",
"versionEndExcluding": "10.0.26100.4061",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
"matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
"matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"matchCriteriaId": "91433700-DB90-4524-8FAE-FF3895C2A45F",
"versionEndExcluding": "10.0.14393.8066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B47EE2B-4081-4D43-8AF7-C8EB11852312",
"versionEndExcluding": "10.0.17763.7314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "76679D4E-C4EF-4EED-BCDE-79F5AF859576",
"versionEndExcluding": "10.0.20348.3692",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9B2720-3733-4C50-85F7-156D781D15B8",
"versionEndExcluding": "10.0.25398.1611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DAE51E4F-FCFF-4DC0-9B76-861EE20D54A4",
"versionEndExcluding": "10.0.26100.4061",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]