What is the CVSS score of CVE-2025-30397?

CVE-2025-30397 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 21.3%.

Is there a public PoC exploit available for CVE-2025-30397?

Yes, a public proof-of-concept exploit is available for CVE-2025-30397. Prioritise patching immediately. EPSS: 21.3%.

How to fix or mitigate CVE-2025-30397?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Windows 10 1507 CVE-2025-30397

HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-05-13 secure@microsoft.com

Authentication Bypass Memory Corruption Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 22h2 Windows 11 23h2 Windows 11 24h2 Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-843 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Type safety enforcement MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	High risk (CVSS 7.5, EPSS 21.3%). Zero-day exploitation in May 2025. The scripting engine is invoked by multiple Windows applications including browsers and Office, providing various delivery vectors.
Exploit ScenarioDerived	A malicious website serves crafted content that triggers the type confusion in the scripting engine. The memory corruption allows execution of attacker code, typically through a ROP chain, providing initial access to the victim's system.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

Exploited in the wild (CISA KEV) No patch listed yet 21.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the network through crafted content processed by the scripting engine.

Earlier versions of this analysis (1)

v1 Mar 28, 2026 - 18:41 CVSS 7.5

A type confusion in the Microsoft Scripting Engine enables remote code execution when processing crafted content, exploited in the wild in May 2025.

RemediationAI

Apply May 2025 security updates. Restrict scripting engine usage through Group Policy where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The CWE-843 type confusion allows an attacker to cause the scripting engine to misinterpret an object's type, leading to memory corruption and code execution when the engine accesses the object through the incorrect type interface.

Know when Windows 10 1507 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Oct 27, 2025 - 17:13 cisa

CISA KEV

PoC Detected

Oct 27, 2025 - 17:13 vuln.today

Public exploit code

CVE Published

May 13, 2025 - 17:16 nvd

HIGH 7.5

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

Executive ViewAI

Why It Matters

CVE-2025-30397 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

21.3%

Top 4% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

CISA KEV

EPSS

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 21.3%

Patch available No

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

129

Low Medium High Critical

KEV: +50

EPSS: +21

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*

cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

More in Windows 10 1507

View all

CVE-2021-40444 HIGH Act Now POC

8.8 Sep 15

Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX

CVE-2021-34527 HIGH Act Now POC

8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi

CVE-2022-30190 HIGH Act Now POC

7.8 Jun 01

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f

CVE-2017-0147 HIGH Act Now POC

7.5 Mar 17

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

CVE-2021-1675 HIGH Act Now POC

7.8 Jun 08

Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth

CVE-2016-7255 HIGH Act Now POC

7.8 Nov 10

The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited

CVE-2023-36884 HIGH Act Now POC

7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo

CVE-2024-30088 HIGH Act Now POC

7.0 Jun 11

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR

CVE-2019-1458 HIGH Act Now POC

7.8 Dec 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2018-8453 HIGH Act Now POC

7.8 Oct 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2020-1054 HIGH Act Now POC

7.0 May 21

Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to S

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all

CVE-2011-0611 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2017-8291 HIGH POC

7.8

CVE-2016-7201 HIGH POC

8.8

CVE-2017-0037 HIGH POC

8.1

CVE-2019-0752 HIGH POC

7.5

CVE-2017-5070 HIGH POC

8.8

CVE-2023-3079 HIGH POC

8.8

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30397 REF https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-mitigation-script

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back