Cyber Posture

CVE-2025-21277

High

Published: 14 January 2025

Published
14 January 2025
Modified
27 January 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.3033 96.7th percentile
Risk Priority 33 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-21277 is a high-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely remediation of flaws like CVE-2025-21277 through vendor patches, directly eliminating the MSMQ DoS vulnerability.

preventdetect

Implements denial-of-service protections such as rate limiting and traffic filtering to block or limit the unauthenticated network-based MSMQ DoS attacks.

preventrecover

Ensures resource availability for MSMQ by protecting against degradation from DoS exploitation through allocation controls and failover mechanisms.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Direct network-exploitable DoS in MSMQ maps to public-facing app exploitation and application/system exploitation for availability impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

Deeper analysisAI

CVE-2025-21277 is a Denial of Service vulnerability in Microsoft Message Queuing (MSMQ). It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-126 and NVD-CWE-noinfo. The vulnerability was published on 2025-01-14.

An unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation results in a high impact on availability, enabling denial of service against affected MSMQ instances.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21277 provides details on mitigation and patches.

Details

CWE(s)

Affected Products

microsoft
windows 10 1507
≤ 10.0.10240.20890 · ≤ 10.0.10240.20890
microsoft
windows 10 1607
≤ 10.0.14393.7699 · ≤ 10.0.14393.7699
microsoft
windows 10 1809
≤ 10.0.17763.6775 · ≤ 10.0.17763.6775
microsoft
windows 10 21h2
≤ 10.0.19044.5371
microsoft
windows 10 22h2
≤ 10.0.19045.5371
microsoft
windows 11 22h2
≤ 10.0.22621.4751
microsoft
windows 11 23h2
≤ 10.0.22631.4751
microsoft
windows 11 24h2
≤ 10.0.26100.2894
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
+5 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-20846Same product: Microsoft Windows 10 1607
CVE-2025-50177Same product: Microsoft Windows 10 1507
CVE-2025-21369Same product: Microsoft Windows 10 1507
CVE-2025-21276Same product: Microsoft Windows 10 1507
CVE-2025-21220Same product: Microsoft Windows 10 1507
CVE-2025-21270Same product: Microsoft Windows 10 1507
CVE-2025-21230Same product: Microsoft Windows 10 1507
CVE-2025-21368Same product: Microsoft Windows 10 1507
CVE-2025-21290Same product: Microsoft Windows 10 1507
CVE-2025-21300Same product: Microsoft Windows 10 1507

References