PT-2025-15539 · Microsoft · Remote Desktop Gateway Service+1

Ʌ!Ɔ⊥Ojv · Published 2025-04-08 · Updated 2025-04-13 · CVE-2025-27480

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Services (affected versions not specified)

Description: The issue allows remote attackers to execute arbitrary code and affect the system. This is due to a use-after-free condition in the Windows Remote Desktop Gateway Service, where the application improperly manages memory. An attacker can exploit this flaw by timing their actions accurately to manipulate freed memory references and execute malicious code, significantly impacting device security and integrity. No user interaction or privileges are required for exploitation, increasing the risk for organizations.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-04049

CVE-2025-27480

Affected Products

Remote Desktop Gateway Service

Windows

References · 17

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27480 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-27480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27480 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27480 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04049 · Security Note
• https://reddit.com/r/sysadmin/comments/1jydaol/remote_desktop_issues_after_april_cumulative · Reddit Post
• https://reddit.com/r/pwnhub/comments/1jv83ag/critical_windows_remote_desktop_vulnerability · Reddit Post
• https://twitter.com/JensHilbig/status/1909879629311356935 · Twitter Post
• https://reddit.com/r/RemoteDesktopServices/comments/1jydc3k/remote_desktop_issues_after_202504_cus · Reddit Post
• https://reddit.com/r/Action1/comments/1jvdfks/%F0%9D%90%82%F0%9D%90%AB%F0%9D%90%A2%F0%9D%90%AD%F0%9D%90%A2%F0%9D%90%9C%F0%9D%90%9A%F0%9D%90%A5_%F0%9D%90%80%F0%9D%90%A5%F0%9D%90%9E%F0%9D%90%AB%F0%9D%90%AD%F0%9D%90%AC_%F0%9D%90%9F%F0%9D%90%A8%F0%9D%90%AB_%F0%9D%90%82%F0%9D%90%88%F0%9D%90%92%F0%9D%90%8E%F0%9D%90%AC_%F0%9D%90%99%F0%9D%90%9E%F0%9D%90%AB%F0%9D%90%A8%F0%9D%90%83%F0%9D%90%9A%F0%9D%90%B2_%F0%9D%90%84%F0%9D%90%B1%F0%9D%90%A9%F0%9D%90%A5%F0%9D%90%A8%F0%9D%90%A2%F0%9D%90%AD%F0%9D%90%9E%F0%9D%90%9D_%F0%9D%90%8C%F0%9D%90%9A%F0%9D%90%A3%F0%9D%90%A8%F0%9D%90%AB · Reddit Post
• https://reddit.com/r/AskWindowsQuery/comments/1juyfyw/microsoft_patch_tuesday_update_april_2025_121 · Reddit Post
• https://reddit.com/r/WindowsServer/comments/1jydbx0/remote_desktop_issues_after_202504_cus · Reddit Post
• https://twitter.com/CVEnew/status/1909665163151659049 · Twitter Post
• https://twitter.com/CareWeDoNot/status/1910014980130582614 · Twitter Post