EUVD-2025-17794Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
AnalysisAI
Use-after-free vulnerability in Windows Remote Desktop Services (RDS) that allows unauthenticated network attackers to execute arbitrary code with high complexity requirements. The vulnerability affects Windows systems running RDS and represents a critical remote code execution risk; exploitation requires network access but no user interaction, though attack complexity is rated as high. If this CVE has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, it indicates active exploitation in the wild and should be treated as an immediate priority.
Technical ContextAI
This vulnerability stems from a use-after-free memory safety defect (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) in the Windows Remote Desktop Services protocol handler. Use-after-free conditions occur when memory is accessed after being freed, typically in multi-threaded environments where race conditions between memory allocation and deallocation create exploitable windows. RDS operates over network protocols (typically TCP port 3389 and related ports) and handles session management, graphics rendering, and input processing. The root cause likely involves improper synchronization in RDS's session state management or protocol parsing routines, where an attacker can craft network packets that trigger a race condition, causing the RDS process to reference memory that has already been freed. This allows arbitrary code execution within the SYSTEM or LOCAL_SERVICE context that RDS typically operates under. The high-complexity CVSS rating suggests the attacker must meet specific timing or environmental conditions to reliably trigger the vulnerability.
RemediationAI
Apply the latest Windows security patch released by Microsoft addressing CVE-2025-32710—refer to Microsoft's MSRC (Microsoft Security Response Center) advisory for specific KB article numbers and patch versions. For Windows Server, deploy updates to affected versions; for Windows client systems, ensure automatic updates are enabled or manually install patches. Interim mitigations pending patching: (1) Restrict RDS access via network segmentation and firewall rules—disable RDS on systems not requiring it; (2) Implement network-level authentication (NLA) in RDS settings to add an authentication layer before protocol processing; (3) Apply principle of least privilege—limit who can access RDS endpoints; (4) Monitor RDS services for suspicious activity and unexpected restarts; (5) Consider disabling RDS entirely if not operationally required. Verify patch installation by checking installed KB articles and validating RDS service version post-update.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-362 – Race Condition
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today