CVE-2025-29969
Published May 13, 2025
Last updated a year ago
AI description
CVE-2025-29969 is identified as a Time-of-check time-of-use (TOCTOU) race condition vulnerability found within Windows Fundamentals. This flaw, disclosed on May 13, 2025, affects a broad range of Microsoft Windows operating systems, including various versions of Windows Server (2008, 2012, 2016, 2019, 2022, 2025), Windows 10, and Windows 11. Successful exploitation of this vulnerability could allow an authorized attacker to execute code over a network. Microsoft addressed CVE-2025-29969 by releasing security updates as part of its May 2025 Patch Tuesday releases.
- Description
- Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.
- Source
- secure@microsoft.com
- NVD status
- Analyzed
- Products
- windows_10_1507, windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 5.9
- Exploitability score
- 1.6
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- secure@microsoft.com
- CWE-367
- Hype score
- Not currently trending
WindowsイベントログサービスのRPCインターフェースで脆弱性(CVE-2026-50502)、修正済みのCVE-2025-29969検証ロジックの盲点を突くPoCが公開 https://t.co/7A8SGGszMU #セキュリティ対策Lab #security #securitynews #脆弱性
@securityLab_jp
31 Jul 2026
151 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Windowsイベントログの遠隔コード実行脆弱性CVE-2026-50502に対応するPoC（攻撃の概念実証コード）が公開された。7月の定例更新で修正されていたもので、CVSSスコア8.0。名前付きパイプ\pipe\eventlogから到達可能なMS-
@__kokumoto
30 Jul 2026
696 Impressions
1 Retweet
7 Likes
2 Bookmarks
0 Replies
0 Quotes
Microsoft : "on a bien patché la CVE-2025-29969" @HackAndDo : "hold my beer" Microsoft : "😮" Pour les détails, c'est sur le blog de Login Sécurité : https://t.co/ZTheLZz4XN
@LoginSecurite
21 Jul 2026
933 Impressions
4 Retweets
6 Likes
4 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://t.co/HlpFwIFJ70 #cyber #threathunting #infosec
@blueteamsec1
22 Mar 2026
782 Impressions
4 Retweets
5 Likes
2 Bookmarks
0 Replies
0 Quotes
EventLogin CVE-2025-29969 A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes Source: https://t.co/d8OwtV3Z8m Research: https://t.co/IwYjeBzmpr h
@HackingTeam77
17 Mar 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
EventLogin — CVE-2025-29969 A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes 🔗 Source: https://t.co/Zyd4CI6RvG 🔗 Research:
@ksg93rd
16 Mar 2026
1063 Impressions
4 Retweets
23 Likes
9 Bookmarks
0 Replies
0 Quotes
SafeBreach Labs found CVE-2025-29969. This high-severity heap-based buffer overflow allows unauthenticated RCE in Trend Micro Apex One and Worry-Free Business Security products. Patches have been released. PS: Visit olivermaicher[.]eu
@cybrmaker
1 Mar 2026
146 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SafeBreach discovered CVE-2025-29969 in Microsoft Azure Site Recovery agent. This allows Local Privilege Escalation by loading a malicious DLL with SYSTEM privileges. Microsoft patched the flaw in June 2024. Update your ASR agents.
@cybrmaker
27 Feb 2026
33 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Top 5 Trending CVEs: 1 - CVE-2018-17144 2 - CVE-2025-29969 3 - CVE-2025-11730 4 - CVE-2026-21518 5 - CVE-2025-60021 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W
@CVEShield
23 Feb 2026
133 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969): https://t.co/XwGKrXG07J #cybersecurity #informationsecurity #infosec #vulnerability #cve #windows #exploitation https://t.co/fxXCPUPzkU
@blackstormsecbr
21 Feb 2026
111 Impressions
2 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29969 EventLogin A flaw in the MS-EVEN protocol. Low-privileged users can write arbitrary files to a remote machine, effectively bypassing the need for an administrator account for remote file writes https://t.co/otpejBHrCl #dfir #blueteam #redteam #pentesting #cve
@co11ateral
21 Feb 2026
1871 Impressions
15 Retweets
39 Likes
21 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://t.co/P2dLQGXZXm
@Dinosn
20 Feb 2026
824 Impressions
0 Retweets
9 Likes
3 Bookmarks
0 Replies
0 Quotes
Discovery & Analysis of CVE-2025-29969 https://t.co/nN8cpjcss8
@_r_netsec
20 Feb 2026
517 Impressions
2 Retweets
6 Likes
1 Bookmark
0 Replies
0 Quotes
Discovery & Analysis of CVE-2025-29969 https://t.co/0SOqskqryK https://t.co/hNltLVY1wW
@secharvesterx
20 Feb 2026
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
EventLog-in: Propagating With Weak Credentials Using the Eventlog Service in Microsoft Windows (CVE-2025-29969) https://t.co/sShgXMlb08 https://t.co/Jd2d8kP1e3
@warthogtk
19 Feb 2026
60 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
New blog & exploit about CVE-2025-29969 - RCE by Yarin Aharoni @safebreach Labs. Findings allow: ---- * Checking arbitrary paths existence (unfixed!). * Writing files remotely (RCE). ---- On ALL Windows & Windows Server computers in the domain! Repo - https://t.co/Ygs0t7
@oryair1999
19 Feb 2026
4125 Impressions
26 Retweets
66 Likes
34 Bookmarks
1 Reply
0 Quotes
New blog & exploit about CVE-2025-29969 - RCE by Yarin Aharoni @safebreach Labs. Findings allow: ---- * Checking arbitrary paths existence (unfixed!). * Writing files remotely (RCE). ---- On ALL Windows & Windows Server computers in the domain! Exploit - https://t.co/Ygs
@oryair1999
19 Feb 2026
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29969 is an RPC #RemoteCodeExecution vulnerability, base score 7.5. Exploits a time-of-check time-of-use & affects Windows vers 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1, 2008 SP2; Win 11 22H2/23H2/24H2, Win 10 1607/1809/21H2/22H2. https://t.co/jrd1brZLjs
@ZeroNLabs
15 May 2025
285 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
1 Quote
🛡️ Windows just revealed a critical vulnerability—CVE-2025-29969—that’s like a race in reverse! Don’t let those pesky RPC conditions trip you up. Time to patch up your defenses! #WindowsForum #CyberSecurity #CVE2025 https://t.co/MBbTQeW9Ir
@windowsforum
14 May 2025
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29969 Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network. https://t.co/9AgHdd397q
@CVEnew
13 May 2025
226 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "0B6B5CAA-8A5A-4676-BC01-CD97BDCE5763",
"versionEndExcluding": "10.0.10240.21014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "4E77111E-B41A-4E88-AC0B-2EBEC9E042FF",
"versionEndExcluding": "10.0.10240.21014",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "A725E104-8456-4AE8-9A9D-10127FC36BDE",
"versionEndExcluding": "10.0.14393.8066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "4720EC2C-1371-4D1F-80E6-7804D079C183",
"versionEndExcluding": "10.0.14393.8066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "63199B82-79B6-461A-AC6D-CD1EE5EBCC80",
"versionEndExcluding": "10.0.17763.7314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "C7D99F6B-B97B-4010-AA5C-84E9FE50D860",
"versionEndExcluding": "10.0.17763.7314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "8047D88E-3BAD-4DCE-A1CD-68BEBEE06D50",
"versionEndExcluding": "10.0.19044.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "66B77F75-39F2-46EE-BC6F-06650808568E",
"versionEndExcluding": "10.0.19044.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "63101BFA-2F60-49BD-8E03-6F13FA9A106D",
"versionEndExcluding": "10.0.19044.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "26BA0DF8-5B45-4B1D-A5F2-3D3B7A60AF90",
"versionEndExcluding": "10.0.19045.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "404F532F-861B-42E0-B31D-325E5CFEE8EC",
"versionEndExcluding": "10.0.19045.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "2A951F53-2D80-44A8-ADE4-9E26702BB76E",
"versionEndExcluding": "10.0.19045.5854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "CA321DC2-D196-4C81-87E8-B1A240A75CB8",
"versionEndExcluding": "10.0.22621.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "CA476FFD-741C-4534-AA84-BA3511AE1413",
"versionEndExcluding": "10.0.22621.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "28D1BDF2-8DF7-48DF-BBF7-E5DE3EF243D1",
"versionEndExcluding": "10.0.22631.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "3F66E394-51B6-48B2-AFF6-A45007E654AD",
"versionEndExcluding": "10.0.22631.5335",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
"matchCriteriaId": "4448191F-2152-4E7F-8D4A-4EE7ED6657D6",
"versionEndExcluding": "10.0.26100.4061",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "7CE8E58A-59AA-4649-8C0F-0DB11A1D1936",
"versionEndExcluding": "10.0.26100.4061",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
"matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
"matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"matchCriteriaId": "91433700-DB90-4524-8FAE-FF3895C2A45F",
"versionEndExcluding": "10.0.14393.8066",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B47EE2B-4081-4D43-8AF7-C8EB11852312",
"versionEndExcluding": "10.0.17763.7314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "76679D4E-C4EF-4EED-BCDE-79F5AF859576",
"versionEndExcluding": "10.0.20348.3692",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9B2720-3733-4C50-85F7-156D781D15B8",
"versionEndExcluding": "10.0.25398.1611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DAE51E4F-FCFF-4DC0-9B76-861EE20D54A4",
"versionEndExcluding": "10.0.26100.4061",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]