#VU112575 Double free in Windows and Windows Server - CVE-2025-49693

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU112575

#VU112575 Double free in Windows and Windows Server - CVE-2025-49693

Published: July 9, 2025


Vulnerability identifier: #VU112575
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-49693
CWE-ID: CWE-415
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Windows
Windows Server
Software vendor:
Microsoft

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Microsoft Brokering File System. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code on the target system with elevated privileges.


Remediation

Install updates from vendor's website.

External links