PT-2025-21001 · Microsoft · Scripting Engine+1

Oruga · Published 2025-05-13 · Updated 2026-02-05 · CVE-2025-30397

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Scripting Engine (affected versions not specified)

Description The issue is related to a type confusion vulnerability in the Microsoft Scripting Engine, which allows an unauthorized attacker to execute code over a network. This can be achieved by exploiting the vulnerability when a user visits a malicious webpage, particularly in Microsoft Edge or Internet Explorer mode. The vulnerability has been actively exploited in the wild.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BDU:2025-05436

CVE-2025-30397

Affected Products

Scripting Engine

Windows

References · 67

• 🔥 https://github.com/mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free- · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-detection-script · Exploit
• 🔥 https://exploit-db.com/exploits/52315 · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-30397 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30397 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30397 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30397 · Security Note
• https://bdu.fstec.ru/vul/2025-05436 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/721016 · Security Note
• https://twitter.com/transilienceai/status/1924819508012671095 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30397 · Note
• https://twitter.com/varwar1337/status/1922349126815006951 · Twitter Post
• https://twitter.com/ScyScan/status/1922412525108502974 · Twitter Post