Vulnerability-Lookup

MSRC_CVE-2025-24060

Vulnerability from csaf_microsoft - Published: 2025-04-08 07:00 - Updated: 2025-04-08 07:00

Summary

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Severity

Important

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.

CVE-2025-24060

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE-20 - Improper Input Validation

Vendor Fix 10.0.17763.7136:Security Update:https://support.microsoft.com/help/5055519 https://support.microsoft.com/help/5055519

Vendor Fix 10.0.20348.3453:Security Update:https://support.microsoft.com/help/5055526 https://support.microsoft.com/help/5055526

Vendor Fix 10.0.19044.5737:Security Update:https://support.microsoft.com/help/5055518 https://support.microsoft.com/help/5055518

Vendor Fix 10.0.22621.5189:Security Update:https://support.microsoft.com/help/5055528 https://support.microsoft.com/help/5055528

Vendor Fix 10.0.19045.5737:Security Update:https://support.microsoft.com/help/5055518 https://support.microsoft.com/help/5055518

Vendor Fix 10.0.26100.3775:Security Update:https://support.microsoft.com/help/5055523 https://support.microsoft.com/help/5055523

Vendor Fix 10.0.22631.5189:Security Update:https://support.microsoft.com/help/5055528 https://support.microsoft.com/help/5055528

Vendor Fix 10.0.25398.1551:Security Update:https://support.microsoft.com/help/5055527 https://support.microsoft.com/help/5055527

References

URL

Category

	https://msrc.microsoft.com/update-guide/vulnerabi…	self
	https://msrc.microsoft.com/csaf/advisories/2025/m…	self
	https://www.microsoft.com/en-us/msrc/exploitabili…	external
	https://support.microsoft.com/lifecycle	external
	https://www.first.org/cvss	external
	https://msrc.microsoft.com/update-guide/vulnerabi…	self
	https://msrc.microsoft.com/csaf/advisories/2025/m…	self

Acknowledgments

YanZiShuang@BigCJTeam of cyberkl

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "YanZiShuang@BigCJTeam of cyberkl"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-24060 Microsoft DWM Core Library Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24060"
      },
      {
        "category": "self",
        "summary": "CVE-2025-24060 Microsoft DWM Core Library Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-24060.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft DWM Core Library Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2025-04-08T07:00:00.000Z",
      "generator": {
        "date": "2026-01-06T16:33:41.635Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-24060",
      "initial_release_date": "2025-04-08T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-04-08T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.17763.7136",
            "product": {
              "name": "Windows 10 Version 1809 for 32-bit Systems \u003c10.0.17763.7136",
              "product_id": "21"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.17763.7136",
            "product": {
              "name": "Windows 10 Version 1809 for 32-bit Systems 10.0.17763.7136",
              "product_id": "11568"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 1809 for 32-bit Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.17763.7136",
            "product": {
              "name": "Windows 10 Version 1809 for x64-based Systems \u003c10.0.17763.7136",
              "product_id": "20"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.17763.7136",
            "product": {
              "name": "Windows 10 Version 1809 for x64-based Systems 10.0.17763.7136",
              "product_id": "11569"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 1809 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.17763.7136",
            "product": {
              "name": "Windows Server 2019 \u003c10.0.17763.7136",
              "product_id": "19"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.17763.7136",
            "product": {
              "name": "Windows Server 2019 10.0.17763.7136",
              "product_id": "11571"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2019"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.17763.7136",
            "product": {
              "name": "Windows Server 2019 (Server Core installation) \u003c10.0.17763.7136",
              "product_id": "18"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.17763.7136",
            "product": {
              "name": "Windows Server 2019 (Server Core installation) 10.0.17763.7136",
              "product_id": "11572"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2019 (Server Core installation)"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.20348.3453",
            "product": {
              "name": "Windows Server 2022 \u003c10.0.20348.3453",
              "product_id": "17"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.20348.3453",
            "product": {
              "name": "Windows Server 2022 10.0.20348.3453",
              "product_id": "11923"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2022"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.20348.3453",
            "product": {
              "name": "Windows Server 2022 (Server Core installation) \u003c10.0.20348.3453",
              "product_id": "16"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.20348.3453",
            "product": {
              "name": "Windows Server 2022 (Server Core installation) 10.0.20348.3453",
              "product_id": "11924"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2022 (Server Core installation)"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.19044.5737",
            "product": {
              "name": "Windows 10 Version 21H2 for 32-bit Systems \u003c10.0.19044.5737",
              "product_id": "15"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.19044.5737",
            "product": {
              "name": "Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.5737",
              "product_id": "11929"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 21H2 for 32-bit Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.19044.5737",
            "product": {
              "name": "Windows 10 Version 21H2 for ARM64-based Systems \u003c10.0.19044.5737",
              "product_id": "14"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.19044.5737",
            "product": {
              "name": "Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.5737",
              "product_id": "11930"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 21H2 for ARM64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.19044.5737",
            "product": {
              "name": "Windows 10 Version 21H2 for x64-based Systems \u003c10.0.19044.5737",
              "product_id": "13"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.19044.5737",
            "product": {
              "name": "Windows 10 Version 21H2 for x64-based Systems 10.0.19044.5737",
              "product_id": "11931"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 21H2 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.22621.5189",
            "product": {
              "name": "Windows 11 Version 22H2 for ARM64-based Systems \u003c10.0.22621.5189",
              "product_id": "12"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.22621.5189",
            "product": {
              "name": "Windows 11 Version 22H2 for ARM64-based Systems 10.0.22621.5189",
              "product_id": "12085"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 Version 22H2 for ARM64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.22621.5189",
            "product": {
              "name": "Windows 11 Version 22H2 for x64-based Systems \u003c10.0.22621.5189",
              "product_id": "11"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.22621.5189",
            "product": {
              "name": "Windows 11 Version 22H2 for x64-based Systems 10.0.22621.5189",
              "product_id": "12086"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 Version 22H2 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.19045.5737",
            "product": {
              "name": "Windows 10 Version 22H2 for x64-based Systems \u003c10.0.19045.5737",
              "product_id": "10"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.19045.5737",
            "product": {
              "name": "Windows 10 Version 22H2 for x64-based Systems 10.0.19045.5737",
              "product_id": "12097"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 22H2 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.19045.5737",
            "product": {
              "name": "Windows 10 Version 22H2 for ARM64-based Systems \u003c10.0.19045.5737",
              "product_id": "9"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.19045.5737",
            "product": {
              "name": "Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.5737",
              "product_id": "12098"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 22H2 for ARM64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.19045.5737",
            "product": {
              "name": "Windows 10 Version 22H2 for 32-bit Systems \u003c10.0.19045.5737",
              "product_id": "8"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.19045.5737",
            "product": {
              "name": "Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.5737",
              "product_id": "12099"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 Version 22H2 for 32-bit Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.26100.3775",
            "product": {
              "name": "Windows Server 2025 (Server Core installation) \u003c10.0.26100.3775",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.26100.3775",
            "product": {
              "name": "Windows Server 2025 (Server Core installation) 10.0.26100.3775",
              "product_id": "12437"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2025 (Server Core installation)"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.22631.5189",
            "product": {
              "name": "Windows 11 Version 23H2 for ARM64-based Systems \u003c10.0.22631.5189",
              "product_id": "7"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.22631.5189",
            "product": {
              "name": "Windows 11 Version 23H2 for ARM64-based Systems 10.0.22631.5189",
              "product_id": "12242"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 Version 23H2 for ARM64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.22631.5189",
            "product": {
              "name": "Windows 11 Version 23H2 for x64-based Systems \u003c10.0.22631.5189",
              "product_id": "6"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.22631.5189",
            "product": {
              "name": "Windows 11 Version 23H2 for x64-based Systems 10.0.22631.5189",
              "product_id": "12243"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 Version 23H2 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.25398.1551",
            "product": {
              "name": "Windows Server 2022, 23H2 Edition (Server Core installation) \u003c10.0.25398.1551",
              "product_id": "5"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.25398.1551",
            "product": {
              "name": "Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.1551",
              "product_id": "12244"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2022, 23H2 Edition (Server Core installation)"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.26100.3775",
            "product": {
              "name": "Windows 11 Version 24H2 for ARM64-based Systems \u003c10.0.26100.3775",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.26100.3775",
            "product": {
              "name": "Windows 11 Version 24H2 for ARM64-based Systems 10.0.26100.3775",
              "product_id": "12389"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 Version 24H2 for ARM64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.26100.3775",
            "product": {
              "name": "Windows 11 Version 24H2 for x64-based Systems \u003c10.0.26100.3775",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.26100.3775",
            "product": {
              "name": "Windows 11 Version 24H2 for x64-based Systems 10.0.26100.3775",
              "product_id": "12390"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 11 Version 24H2 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.26100.3775",
            "product": {
              "name": "Windows Server 2025 \u003c10.0.26100.3775",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.26100.3775",
            "product": {
              "name": "Windows Server 2025 10.0.26100.3775",
              "product_id": "12436"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2025"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-24060",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.",
          "title": "What privileges could be gained by an attacker who successfully exploited this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "11568",
          "11569",
          "11571",
          "11572",
          "11923",
          "11924",
          "11929",
          "11930",
          "11931",
          "12085",
          "12086",
          "12097",
          "12098",
          "12099",
          "12242",
          "12243",
          "12244",
          "12389",
          "12390",
          "12436",
          "12437"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-24060 Microsoft DWM Core Library Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24060"
        },
        {
          "category": "self",
          "summary": "CVE-2025-24060 Microsoft DWM Core Library Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-24060.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.17763.7136:Security Update:https://support.microsoft.com/help/5055519",
          "product_ids": [
            "21",
            "20",
            "19",
            "18"
          ],
          "url": "https://support.microsoft.com/help/5055519"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.20348.3453:Security Update:https://support.microsoft.com/help/5055526",
          "product_ids": [
            "17",
            "16"
          ],
          "url": "https://support.microsoft.com/help/5055526"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.19044.5737:Security Update:https://support.microsoft.com/help/5055518",
          "product_ids": [
            "15",
            "14",
            "13"
          ],
          "url": "https://support.microsoft.com/help/5055518"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.22621.5189:Security Update:https://support.microsoft.com/help/5055528",
          "product_ids": [
            "12",
            "11"
          ],
          "url": "https://support.microsoft.com/help/5055528"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.19045.5737:Security Update:https://support.microsoft.com/help/5055518",
          "product_ids": [
            "10",
            "9",
            "8"
          ],
          "url": "https://support.microsoft.com/help/5055518"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.26100.3775:Security Update:https://support.microsoft.com/help/5055523",
          "product_ids": [
            "1",
            "4",
            "3",
            "2"
          ],
          "url": "https://support.microsoft.com/help/5055523"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.22631.5189:Security Update:https://support.microsoft.com/help/5055528",
          "product_ids": [
            "7",
            "6"
          ],
          "url": "https://support.microsoft.com/help/5055528"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.25398.1551:Security Update:https://support.microsoft.com/help/5055527",
          "product_ids": [
            "5"
          ],
          "url": "https://support.microsoft.com/help/5055527"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19",
            "20",
            "21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Microsoft DWM Core Library Elevation of Privilege Vulnerability"
    }
  ]
}

CVE-2025-24060 (GCVE-0-2025-24060)

Vulnerability from cvelistv5 – Published: 2025-04-08 17:24 – Updated: 2026-02-13 19:33

Title

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Summary

Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-20 - Improper Input Validation

Assigner

microsoft

References

URL

Tags

https://msrc.microsoft.com/update-guide/vulnerabi…

vendor-advisorypatch

Impacted products

Vendor

Product

Version

Microsoft

Windows 10 Version 1809

Affected: 10.0.17763.0 , < 10.0.17763.7136 (custom)

Microsoft	Windows 10 Version 21H2	Affected: 10.0.19044.0 , < 10.0.19044.5737 (custom)
Microsoft	Windows 10 Version 22H2	Affected: 10.0.19045.0 , < 10.0.19045.5737 (custom)
Microsoft	Windows 11 version 22H2	Affected: 10.0.22621.0 , < 10.0.22621.5189 (custom)
Microsoft	Windows 11 version 22H3	Affected: 10.0.22631.0 , < 10.0.22631.5189 (custom)
Microsoft	Windows 11 Version 23H2	Affected: 10.0.22631.0 , < 10.0.22631.5189 (custom)
Microsoft	Windows 11 Version 24H2	Affected: 10.0.26100.0 , < 10.0.26100.3775 (custom)
Microsoft	Windows Server 2019	Affected: 10.0.17763.0 , < 10.0.17763.7136 (custom)
Microsoft	Windows Server 2019 (Server Core installation)	Affected: 10.0.17763.0 , < 10.0.17763.7136 (custom)
Microsoft	Windows Server 2022	Affected: 10.0.20348.0 , < 10.0.20348.3453 (custom)
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	Affected: 10.0.25398.0 , < 10.0.25398.1551 (custom)
Microsoft	Windows Server 2025	Affected: 10.0.26100.0 , < 10.0.26100.3775 (custom)
Microsoft	Windows Server 2025 (Server Core installation)	Affected: 10.0.26100.0 , < 10.0.26100.3775 (custom)

Date Public ?

2025-04-08 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T19:16:53.619285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T19:17:02.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 1809",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.7136",
              "status": "affected",
              "version": "10.0.17763.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 21H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.19044.5737",
              "status": "affected",
              "version": "10.0.19044.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 22H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.19045.5737",
              "status": "affected",
              "version": "10.0.19045.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "ARM64-based Systems",
            "x64-based Systems"
          ],
          "product": "Windows 11 version 22H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.22621.5189",
              "status": "affected",
              "version": "10.0.22621.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "ARM64-based Systems"
          ],
          "product": "Windows 11 version 22H3",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.22631.5189",
              "status": "affected",
              "version": "10.0.22631.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows 11 Version 23H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.22631.5189",
              "status": "affected",
              "version": "10.0.22631.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "ARM64-based Systems",
            "x64-based Systems"
          ],
          "product": "Windows 11 Version 24H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.26100.3775",
              "status": "affected",
              "version": "10.0.26100.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2019",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.7136",
              "status": "affected",
              "version": "10.0.17763.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2019 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.7136",
              "status": "affected",
              "version": "10.0.17763.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.20348.3453",
              "status": "affected",
              "version": "10.0.20348.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2022, 23H2 Edition (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.25398.1551",
              "status": "affected",
              "version": "10.0.25398.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2025",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.26100.3775",
              "status": "affected",
              "version": "10.0.26100.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2025 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.26100.3775",
              "status": "affected",
              "version": "10.0.26100.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "10.0.17763.7136",
                  "versionStartIncluding": "10.0.17763.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.17763.7136",
                  "versionStartIncluding": "10.0.17763.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.17763.7136",
                  "versionStartIncluding": "10.0.17763.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.20348.3453",
                  "versionStartIncluding": "10.0.20348.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "10.0.19044.5737",
                  "versionStartIncluding": "10.0.19044.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_11_22H2:*:*:*:*:*:*:arm64:*",
                  "versionEndExcluding": "10.0.22621.5189",
                  "versionStartIncluding": "10.0.22621.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "10.0.19045.5737",
                  "versionStartIncluding": "10.0.19045.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.26100.3775",
                  "versionStartIncluding": "10.0.26100.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*",
                  "versionEndExcluding": "10.0.22631.5189",
                  "versionStartIncluding": "10.0.22631.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "10.0.22631.5189",
                  "versionStartIncluding": "10.0.22631.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_23h2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.25398.1551",
                  "versionStartIncluding": "10.0.25398.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*",
                  "versionEndExcluding": "10.0.26100.3775",
                  "versionStartIncluding": "10.0.26100.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.26100.3775",
                  "versionStartIncluding": "10.0.26100.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-04-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-13T19:33:37.456Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft DWM Core Library Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24060"
        }
      ],
      "title": "Microsoft DWM Core Library Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2025-24060",
    "datePublished": "2025-04-08T17:24:21.635Z",
    "dateReserved": "2025-01-16T23:11:19.733Z",
    "dateUpdated": "2026-02-13T19:33:37.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

MSRC_CVE-2025-24060

CVE-2025-24060 (GCVE-0-2025-24060)

Tags

Sightings

Nomenclature