CVE-2025-21295
Published: 14 January 2025
Summary
CVE-2025-21295 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 14.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2025-21295 is a remote code execution vulnerability in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism. It is tracked under CWE-416 and carries a CVSS 3.1 base score of 8.1, reflecting network attack vector, high complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the flaw over the network to achieve arbitrary code execution on the affected system. The attack requires a non-trivial level of complexity but does not depend on any prior authentication or user assistance.
The sole reference points to the Microsoft Security Response Center advisory for CVE-2025-21295, which is the authoritative source for patch availability and mitigation guidance. The associated EPSS score remains low, with a current value of 0.0232 and a peak of 0.0300.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2360
Vulnerability details
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an unauthenticated remote code execution vulnerability in the NEGOEX security mechanism with network attack vector and no user interaction, directly enabling exploitation of remote services.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the SPNEGO NEGOEX remote code execution vulnerability (CVE-2025-21295) by requiring timely installation of vendor patches as specified in the Microsoft update guide.
Mitigates remote code execution exploitation of the use-after-free (CWE-416) flaw in NEGOEX by enforcing memory protections like ASLR and DEP to prevent arbitrary code execution.
Limits network-based exploitation of the unauthenticated remote vulnerability by monitoring and controlling communications at boundaries to restrict access to affected services.