CVE-2025-49683 : Detail

CVE-2025-49683

7.8
/
High
0.72%V4
Local
2025-07-08
16h57 +00:00
2025-08-23
00h40 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Microsoft Virtual Hard Disk Remote Code Execution Vulnerability

Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to execute code locally.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-190 Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-122 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Metrics

Metrics Score Severity CVSS Vector Source
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

None

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Required

Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Exploit Code Maturity

This metric measures the likelihood of the vulnerability being attacked, and is typically based on the current state of exploit techniques, exploit code availability, or active, “in-the-wild” exploitation.

Unproven

No exploit code is available, or an exploit is theoretical.

Remediation Level

The Remediation Level of a vulnerability is an important factor for prioritization.

Official fix

A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.

Report Confidence

This metric measures the degree of confidence in the existence of the vulnerability and the credibility of the known technical details.

Confirmed

Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

None

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

Required

Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 secure@microsoft.com

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 52394

Publication date : 2025-08-02 22h00 +00:00
Author : nu11secur1ty
EDB Verified : No

# Titles: Microsoft Virtual Hard Disk (VHDX) 11 - Remote Code Execution (RCE) # Author: nu11secur1ty # Date: 07/23/2025 # Vendor: Microsoft # Software: https://www.microsoft.com/en-us/windows/windows-11?r=1 # Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-49683 # Base Score: 7.8 HIGHVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H ## Overview This PowerShell script (`vdh.ps1`) demonstrates a **soft corruption vulnerability** in Windows Virtual Hard Disk (VHDX) handling, related to **CVE-2025-49683**. The script performs the following: - Creates a new dynamic VHDX file (virtual disk) of 10MB size. - Mounts the VHDX as a new drive in the system. - Initializes, partitions, and formats the virtual disk with NTFS. - Dismounts the VHDX and applies **soft byte-level corruption** at an 8 KB offset inside the VHDX file. - Re-mounts the corrupted VHDX to observe potential filesystem or mounting errors. - Lists the contents of the corrupted volume to show the impact. - Creates an **immediate restart batch script (`your-salaries.bat`)** inside the mounted volume which forces a system restart when executed. - Offers cleanup options to dismount and delete the corrupted VHDX file. --- ## Purpose This PoC is designed for **security researchers and penetration testers** to: - Understand how minor VHDX file corruptions can lead to system instability or vulnerability exploitation. - Demonstrate how CVE-2025-49683 affects VHDX mounting and usage. - Help develop detection and mitigation strategies for such virtual disk corruption attacks. --- ## Usage Instructions 1. **Run the script in an elevated PowerShell session** (Run as Administrator - The already malicious authorized user): ```powershell .\vdh.ps1 2. The script will: - Create, mount, and format a new VHDX file. - Corrupt the file at the byte level. - Re-mount and attempt to read the volume. - Create a batch file your-salaries.bat inside the mounted drive. 3. To trigger an immediate restart, navigate to the mounted drive (e.g., D:\) and run: ``` your-salaries.bat ``` 4. At script end, press 0 to clean up (dismount and delete the corrupted VHDX), or press any other key to exit and keep the file for further analysis. ### Important Warnings & Considerations - Run only on test or isolated environments. This script creates corruption and forcibly restarts the system via the batch file. Do not run on production or important machines. - Immediate Restart Batch File The your-salaries.bat file triggers an immediate system restart without any warning or confirmation. Be cautious when executing it. - Corruption is simulated and subtle. The corruption at 8 KB offset is a soft corruption intended for demonstration. Real-world attacks could apply more complex modifications. - Impact may vary by OS version and environment. Results depend on Windows version and configuration. Some systems may detect and repair corruption automatically. - Elevated privileges required. Script requires administrative rights to create, mount, initialize, and corrupt VHDX files. ### Technical Details - Corruption offset: 8192 bytes (8 KB) into the VHDX file. - Corruption pattern: Byte sequence [0x00, 0xFF, 0x00, 0xFF, 0xDE, 0xAD, 0xBE, 0xEF]. - Disk initialization: MBR partition style with a single NTFS partition. - Batch restart command: shutdown /r /t 0 /f to force immediate restart. ### Sample Output ```vbnet [*] Checking for existing VHDX file to avoid conflicts... WARNING: [!] Could not dismount VHDX, maybe not mounted: The path "C:\Users\MicrosoftLoosers\Desktop\CVE-2025-49683\corrupted_test.vhdx" is not the path to a mounted virtual hard disk file. [*] Removed existing VHDX file. [*] Creating new VHDX (Virtual Hard Disk) file... Size: 10 MB Path: C:\Users\MicrosoftLoosers\Desktop\CVE-2025-49683\corrupted_test.vhdx [*] Mounting the new VHDX... [*] Disk initialized and formatted with NTFS. This disk emulates a real drive to test mounting and corruption handling. [*] Drive mounted as E: You can access this drive like a physical hard disk in Windows Explorer. [*] Dismounting the VHDX before applying corruption... [*] Simulating corruption by modifying bytes at offset 8 KB... This models how subtle corruption can affect VHDX file integrity, which may lead to file system errors or crashes when accessed. [+] Corruption successfully applied. Note: This is a soft corruption for testing and demonstration purposes only. [*] Re-mounting the corrupted VHDX to observe effects... [*] Drive letter(s) assigned after corruption: E [*] Listing contents of the mounted drive to detect file system anomalies... [*] Attempting to list contents of drive E:\ ... [*] Created immediate restart batch script: your-salaries.bat Running this batch will force an immediate restart. [*] Script complete. This demo showcases how VHDX file corruption at the byte level can impact system behavior and why patching CVE-2025-49683 is crucial. [*] Press '0' to clean up and remove the corrupted VHDX, or any other key to exit. [*] Cleaning up... [*] VHDX dismounted. [*] Deleted VHDX file. ``` ### License & Disclaimer This script is provided for educational and research purposes only. The author and distributor disclaim all liability for any damage caused by misuse. Use responsibly, and always obtain proper authorization before testing or exploiting vulnerabilities on any system. ### References [CVE-2025-49683]( https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49683) (Windows VHDX file corruption vulnerability) Microsoft Windows Virtual Hard Disk (VHDX) documentation Windows PowerShell documentation # Video: [href](https://www.youtube.com/watch?v=lkEu_AZnzk4) # Source: [href]( https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-49683) # Buy me a coffee if you are not ashamed: [href](https://www.paypal.com/donate/?hosted_button_id=ZPQZT5XMC5RFY) # Source download [href]( https://nu11secur1ty.github.io/DownGit/#/home?url=https://github.com/nu11secur1ty/CVE-mitre/tree/main/2025/CVE-2025-49683 ) # Time spent: 05:35:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/> -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstorm.news/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>

Products Mentioned

Configuraton 0

Microsoft>>Windows_10_1507 >> Version To (excluding) 10.0.10240.21073

Microsoft>>Windows_10_1507 >> Version To (excluding) 10.0.10240.21073

Microsoft>>Windows_10_1607 >> Version To (excluding) 10.0.14393.8246

Microsoft>>Windows_10_1607 >> Version To (excluding) 10.0.14393.8246

Microsoft>>Windows_10_1809 >> Version To (excluding) 10.0.17763.7558

Microsoft>>Windows_10_1809 >> Version To (excluding) 10.0.17763.7558

Microsoft>>Windows_10_21h2 >> Version To (excluding) 10.0.19044.6093

Microsoft>>Windows_10_22h2 >> Version To (excluding) 10.0.19045.6093

Microsoft>>Windows_11_22h2 >> Version To (excluding) 10.0.22621.5624

Microsoft>>Windows_11_23h2 >> Version To (excluding) 10.0.22631.5624

Microsoft>>Windows_11_24h2 >> Version To (excluding) 10.0.26100.4652

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version -

Microsoft>>Windows_server_2008 >> Version r2

Microsoft>>Windows_server_2012 >> Version -

Microsoft>>Windows_server_2012 >> Version r2

Microsoft>>Windows_server_2016 >> Version To (excluding) 10.0.14393.8246

Microsoft>>Windows_server_2019 >> Version To (excluding) 10.0.17763.7558

Microsoft>>Windows_server_2022 >> Version To (excluding) 10.0.20348.3932

Microsoft>>Windows_server_2022_23h2 >> Version To (excluding) 10.0.25398.1732

Microsoft>>Windows_server_2025 >> Version To (excluding) 10.0.26100.4652

References

The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.