PT-2025-6314 · Microsoft · Digest Authentication+1

Yuki Chen · Published 2025-02-11 · Updated 2025-02-12 · CVE-2025-21368

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Digest Authentication (affected versions not specified)

Description: The issue allows remote attackers to execute arbitrary code and affect the system. It is noted that any authenticated attacker could trigger this issue on domain controllers without requiring admin or other elevated privileges. The likelihood of exploitation is considered less likely.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2025-02029

CVE-2025-21368

Affected Products

Digest Authentication

Windows

References · 8

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21368 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21368 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21368 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21368 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02029 · Security Note
• https://twitter.com/Bitterman59/status/1889477197447983176 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB20250211118?utm_source=feedly · Note