PT-2025-21002 · Microsoft · Windows Dwm+1

Published 2025-05-13 · Updated 2025-11-15 · CVE-2025-30400

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows DWM Core Library (affected versions not specified)

Description The issue is related to a use-after-free vulnerability in the Windows Desktop Window Manager (DWM) Core Library. This vulnerability allows an authorized attacker to elevate privileges locally. The vulnerability has been exploited in real-world attacks, with facts of exploitation confirmed. The estimated number of potentially affected devices worldwide is not specified.

Recommendations To resolve the issue, apply the patch with KB5036893/94 for Windows 10, 11, and Server 2025. As a temporary workaround, consider restricting access to the vulnerable DWM Core Library until a patch is available. Avoid using the vulnerable library in sensitive operations until the issue is resolved. At the moment, there is no additional information about other affected versions or specific mitigation measures for them.

Fix

LPE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-05427

CVE-2025-30400

Affected Products

Windows

Windows Dwm

References · 60

• https://nvd.nist.gov/vuln/detail/CVE-2025-30400 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/721015 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-30400 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05427 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30400 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-30400 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30400 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30400 · Security Note
• https://twitter.com/varwar1337/status/1922349126815006951 · Twitter Post
• https://twitter.com/leonov_av/status/1932412525401846149 · Twitter Post
• https://twitter.com/transilienceai/status/1922810159497175455 · Twitter Post
• https://twitter.com/transilienceai/status/1924461509410689333 · Twitter Post
• https://twitter.com/transilienceai/status/1925888836128694535 · Twitter Post
• https://twitter.com/ScyScan/status/1922414040116318347 · Twitter Post
• https://twitter.com/PintoriAlice/status/1922931570148770136 · Twitter Post