CVE-2025-21277
Published: 14 January 2025
Summary
CVE-2025-21277 is a high-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of flaws like CVE-2025-21277 through vendor patches, directly eliminating the MSMQ DoS vulnerability.
Implements denial-of-service protections such as rate limiting and traffic filtering to block or limit the unauthenticated network-based MSMQ DoS attacks.
Ensures resource availability for MSMQ by protecting against degradation from DoS exploitation through allocation controls and failover mechanisms.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct network-exploitable DoS in MSMQ maps to public-facing app exploitation and application/system exploitation for availability impact.
NVD Description
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Deeper analysisAI
CVE-2025-21277 is a Denial of Service vulnerability in Microsoft Message Queuing (MSMQ). It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-126 and NVD-CWE-noinfo. The vulnerability was published on 2025-01-14.
An unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation results in a high impact on availability, enabling denial of service against affected MSMQ instances.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21277 provides details on mitigation and patches.
Details
- CWE(s)