What is the CVSS score of CVE-2025-49678?

CVE-2025-49678 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows Server 2016 are affected by CVE-2025-49678?

CVE-2025-49678 is a privilege escalation vulnerability in Windows NTFS that allows authenticated local users to gain elevated system privileges through a null pointer dereference.. A patch is available.

How to fix or mitigate CVE-2025-49678?

Within 24 hours: identify all Windows systems in your environment and their current NTFS/Windows versions. Within 7 days: test the vendor-released patch in a non-production environment and establish a deployment timeline. Within 30 days: deploy the patch to all vulnerable Windows systems, prioritizing domain controllers, administrative workstations, and servers with sensitive data access.

Windows Server 2016 CVE-2025-49678

EUVD-2025-20572 HIGH

Race Condition (CWE-362)

2025-07-08 secure@microsoft.com

Microsoft Race Condition Denial Of Service Windows Server 2016 Windows 10 22h2 Windows 11 22h2 Windows 10 21h2 Windows Server 2022 23h2 Windows Server 2022 Windows 11 24h2 Windows 11 23h2 Windows 10 1607 Windows 10 1809 Windows 10 1507 Windows Server 2008 Windows Server 2012 Windows Server 2025 Windows Server 2019 Windows

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:31 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.3.9600.22676,10.0.25398.1732,10.0.22631.5624

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20572

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 17:15 nvd

HIGH 7.0

DescriptionCVE.org

Null pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

Analysis

Null pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.

Technical ContextAI

A race condition occurs when the behavior of software depends on the timing of events, such as the order of execution of threads or processes.

RemediationAI

Use proper synchronization mechanisms (locks, mutexes, atomic operations). Implement file locking for filesystem operations. Avoid TOCTOU patterns.

More in Windows Server 2016

View all

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2025-21293 HIGH Act Now POC

8.8 Jan 14

Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users

CVE-2017-8682 HIGH Act Now POC

8.8 Sep 13

Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a

CVE-2025-30397 HIGH Act Now POC

7.5 May 13

Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the

CVE-2017-0038 MEDIUM This Month POC

5.5 Feb 20

gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows

CVE-2017-0283 HIGH Act Now POC

8.8 Jun 15

Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT

CVE-2017-11885 MEDIUM This Month POC

6.6 Dec 12

Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold,

CVE-2016-7237 MEDIUM This Month POC

6.5 Nov 10

Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, W

CVE-2017-11771 CRITICAL Act Now

9.8 Oct 13

The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Wind

CVE-2026-56155 HIGH Act Now POC

7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2025-32706 HIGH Act Now POC

7.8 May 13

Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne

Same weakness CWE-362 – Race Condition

View all

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2015-5754 CRITICAL POC

9.3

CVE-2015-8556 CRITICAL POC

10.0

Same technique Race Condition

View all

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2026-27175 CRITICAL POC

9.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2015-5754 CRITICAL POC

9.3

CVE-2025-49678 vulnerability details – vuln.today

Back

Windows Server 2016 CVE-2025-49678

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Windows Server 2016

Same weakness CWE-362 – Race Condition

Same technique Race Condition

Share

External POC / Exploit Code