PT-2025-28587 · Microsoft · Virtual Hard Disk+1

Sergey Tarasov · Published 2025-03-28 · Updated 2025-10-24 · CVE-2025-49689

Positive Technologies · (AI Summary)

CVSS v3.1

7.8

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description An elevation-of-privilege issue exists within the Windows Virtual Hard Disk (VHDX) component, specifically related to dereferencing an untrusted pointer. Successful exploitation of this issue could allow an attacker to gain elevated privileges, potentially reaching SYSTEM-level access. The issue stems from an integer overflow or wraparound condition within the VHDX processing logic. A crafted VHD file can be used to gain full control of a system. The vulnerability affects 37 Windows desktop and server builds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Out of bounds Read

Untrusted Pointer Dereference

Weakness Enumeration

CWE-190

CWE-125

CWE-822

Related Identifiers

BDU:2025-08306

CVE-2025-49689

Affected Products

Virtual Hard Disk

Windows

References · 20

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49689 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/722774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49689 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-49689 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08306 · Security Note
• https://reddit.com/r/CVEWatch/comments/1lxwvlc/top_10_trending_cves_12072025 · Reddit Post
• https://twitter.com/the_yellow_fall/status/1943506864689324428 · Twitter Post
• https://twitter.com/immortalp0ny/status/1942995521498452097 · Twitter Post
• https://twitter.com/amoshkov/status/1981567703296233526 · Twitter Post
• https://twitter.com/CVEnew/status/1942958468442231183 · Twitter Post
• https://twitter.com/autumn_good_35/status/1943255516450558037 · Twitter Post
• https://swarm.ptsecurity.com/buried-in-the-log-exploiting-a-20-years-old-ntfs-vulnerability · Note
• https://t.me/ptswarm/238 · Telegram Post