PT-2025-28587 · Microsoft · Virtual Hard Disk +1

Sergey Tarasov · Published 2025-03-28 · Updated 2025-09-07 · CVE-2025-49689

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

Microsoft Windows Virtual Hard Disk (VHDX) (affected versions not specified)

**Description:**

An integer overflow or wraparound condition exists in Virtual Hard Disk (VHDX) that may allow an unauthorized attacker to elevate privileges locally. The issue affects the NTFS file system on Microsoft Windows.

**Recommendations:**

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Pointer Dereference

Integer Overflow

Out of bounds Read

Weakness Enumeration

CWE-822

CWE-190

CWE-125

Related Identifiers

BDU:2025-08306

CVE-2025-49689

Affected Products

Virtual Hard Disk

Windows

References · 18

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-49689 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49689 · Security Note
• https://bdu.fstec.ru/vul/2025-08306 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/722774 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49689 · Security Note
• https://t.me/avleonovcom/1561 · Telegram Post
• https://twitter.com/PTsecurity_EN/status/1943535727473758474 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1lw8z1z/top_10_trending_cves_10072025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1lxwvlc/top_10_trending_cves_12072025 · Reddit Post
• https://twitter.com/the_yellow_fall/status/1943506864689324428 · Twitter Post
• https://twitter.com/CVEnew/status/1942958468442231183 · Twitter Post
• https://twitter.com/autumn_good_35/status/1943255516450558037 · Twitter Post
• https://twitter.com/ptswarm/status/1942948636385542402 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1lx3484/top_10_trending_cves_11072025 · Reddit Post