Windows CVE-2025-32716

CVSS 7.8 reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), but this must be contextualized: (1) Attack Vector is Local (AV:L), significantly reducing attack surface compared to network-based vectors; (2) Attack Complexity is Low (AC:L), meaning exploitation is straightforward once access is gained; (3) Privilege Requirement is Low (PR:L), indicating an authenticated user can trigger this—not requiring administrative credentials; (4) No User Interaction required (UI:N) strengthens the severity. Without disclosed EPSS data, KEV/CISA status, or confirmed POC availability, the real-world priority depends on: Windows Media usage patterns in target environments, whether automated exploitation is feasible, and whether system architecture (x86/x64/ARM) affects exploitability. In corporate environments where standard users have limited system access, the actual risk may be lower than the CVSS suggests; in shared systems or developer workstations, it is more critical.

A standard non-administrative user on a Windows system processes a specially crafted media file (via Media Player, Windows Photo Viewer, or another Windows Media API consumer) either received via email, USB, or internal network share. The out-of-bounds read triggers during media parsing, leaking kernel memory or other process memory containing privilege escalation gadgets or token information. The attacker uses this information to chain the memory disclosure with additional exploits to achieve SYSTEM-level execution. Alternatively, if the out-of-bounds read corrupts application state, it could directly crash privileged processes or enable code execution within a privileged context. Exploitation requires local code execution capability and media file delivery; no remote vector exists. POC status is unknown from provided data—absence of public POC does not indicate exploitability difficulty.