CVE-2025-59282

Published Oct 14, 2025

Last updated 7 days ago

IIS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59282 is a vulnerability affecting Internet Information Services (IIS) Inbox COM Objects. It stems from a race condition (CWE-362) and a use-after-free scenario (CWE-416) within shared memory components. The vulnerability is due to concurrent execution using a shared resource with improper synchronization. An attacker could exploit this vulnerability to execute code locally. This requires the attacker to craft a malicious file and trick a local user into opening it. Successful exploitation could allow arbitrary code execution with elevated privileges on the same machine.

Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.
Source: secure@microsoft.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-362

Hype score: Not currently trending

References