PT-2025-28587 · Microsoft · Virtual Hard Disk +1

Sergey Tarasov

·

Published

2025-03-28

·

Updated

2025-10-24

·

CVE-2025-49689

CVSS v3.1
7.8
VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)
Description An elevation-of-privilege issue exists within the Windows Virtual Hard Disk (VHDX) component, specifically related to dereferencing an untrusted pointer. Successful exploitation of this issue could allow an attacker to gain elevated privileges, potentially reaching SYSTEM-level access. The issue stems from an integer overflow or wraparound condition within the VHDX processing logic. A crafted VHD file can be used to gain full control of a system. The vulnerability affects 37 Windows desktop and server builds.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Integer Overflow

Untrusted Pointer Dereference

Weakness Enumeration

CWE-125CWE-190CWE-822

Related Identifiers

BDU:2025-08306
CVE-2025-49689

Affected Products

Virtual Hard Disk
Windows