PT-2025-4200 · Microsoft · Windows Direct Show+1

Published 2025-01-14 · Updated 2025-02-21 · CVE-2025-21291

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Direct Show versions are affected, but specific versions are not provided in the input data.

Description The issue is related to remote code execution in Windows Direct Show. It allows remote attackers to execute arbitrary code and affect the system. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations Since no specific affected versions are provided, a general recommendation cannot be accurately tailored to each version. However, typically, to resolve such issues, one would need to apply a patch or update provided by the software vendor for their specific version of Windows Direct Show. Each affected version would require a distinct and explicit fix, which is not detailed in the provided input data.

Fix

RCE

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2025-02095

CVE-2025-21291

Affected Products

Windows

Windows Direct Show

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21291 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21291 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21291 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21291 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/716883 · Security Note
• https://bdu.fstec.ru/vul/2025-02095 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21291 · Security Note
• https://twitter.com/CVEnew/status/1879490221483676142 · Twitter Post
• https://twitter.com/windowsforum/status/1879247399018750262 · Twitter Post