Main Vulnerability Database Vulnerabilities #VU109049

Type confusion in Microsoft products - CVE-2025-30397

Published: May 13, 2025 / Updated: June 6, 2025

Vulnerability identifier: #VU109049

CSH Severity: Critical

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-30397

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in Microsoft Scripting Engine. A remote attacker can trick the victim into opening a specially crafted URL, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Affected software

Microsoft Windows
Windows Server
Microsoft Internet Explorer

How to mitigate CVE-2025-30397

Install updates from vendor's website.

Microsoft Windows - addressed in versions 10 21H2 10.0.19044.5854, 10 22H2 10.0.19045.5854, 10 1507 10.0.10240.21014, 10 1607 10.0.14393.8066, 10 1809 10.0.17763.7314, 11 22H2 10.0.22621.5335, 11 23H2 10.0.22631.5335, 11 24H2 10.0.26100.3981, 11 24H2 10.0.26100.4061
Microsoft Internet Explorer - update to 11.0.9600.22574
Windows Server - addressed in versions 2008 R2 6.1.7601.27729, 2008 6.0.6003.23279, 2012 R2 6.3.9600.22577, 2012 6.2.9200.25475, 2016 10.0.14393.8066, 2019 10.0.17763.7314, 2022 23H2 10.0.25398.1611, 2022 10.0.20348.3630, 2022 10.0.20348.3692, 2025 10.0.26100.3981, 2025 10.0.26100.4061

Links to Public Exploits and PoC-codes

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-30397

Related Security Bulletins

Remote code execution in Microsoft Scripting Engine