CVE-2025-21230
Published: 14 January 2025
Summary
CVE-2025-21230 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific improper input validation flaw in MSMQ by applying vendor-provided patches.
Provides denial-of-service protections such as rate limiting to block exploitation of uncontrolled resource consumption in MSMQ.
Enforces input validation to mitigate CWE-20 improper input validation that enables the MSMQ DoS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated DoS via input validation flaw in MSMQ service directly matches application/system exploitation for availability impact.
NVD Description
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Deeper analysisAI
CVE-2025-21230 is a Denial of Service vulnerability in Microsoft Message Queuing (MSMQ), published on 2025-01-14. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), and NVD-CWE-noinfo.
The vulnerability can be exploited by an unauthenticated attacker over the network, requiring low complexity and no user interaction. Successful exploitation leads to a high impact on availability, potentially causing denial of service on affected MSMQ instances, with no impact on confidentiality or integrity.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21230 provides details on patches and mitigation steps for security practitioners.
Details
- CWE(s)