Which versions of Microsoft are affected by CVE-2025-0416?

Organizations using Valmet DNA face significant risk from CVE-2025-0416, a improper privilege management vulnerability rated CVSS 8.9.

How to fix or mitigate CVE-2025-0416?

Within 7 days: Identify all affected systems running Valmet DNA and apply vendor patches promptly. Monitor vendor channels for patch availability.

Microsoft CVE-2025-0416

Q: What is the CVSS score of CVE-2025-0416?

CVE-2025-0416 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:H/U:Amber. EPSS exploitation probability: 0.1%.

HIGH

Improper Privilege Management (CWE-269)

2025-04-01 db4dfee8-a97e-4877-bfae-eba6d14a2166

Privilege Escalation Microsoft

8.9

CVSS 4.0 · Vendor: db4dfee8-a97e-4877-bfae-eba6d14a2166

Severity by source

Vendor (db4dfee8-a97e-4877-bfae-eba6d14a2166) PRIMARY

8.9 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:H/U:Amber

Primary rating from Vendor (db4dfee8-a97e-4877-bfae-eba6d14a2166) · only source for this CVE.

CVSS VectorVendor: db4dfee8-a97e-4877-bfae-eba6d14a2166

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:34 vuln.today

CVE Published

Apr 01, 2025 - 04:15 nvd

HIGH 8.9

DescriptionCVE.org

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.

AnalysisAI

Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. Rated high severity (CVSS 8.9), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.

Affected ProductsAI

Valmet DNA versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.