CVE-2025-21368
Published: 11 February 2025
Summary
CVE-2025-21368 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the remote code execution flaw in Microsoft Digest Authentication by requiring timely identification, reporting, and correction of known vulnerabilities like CVE-2025-21368.
Protects against stack-based buffer overflow (CWE-122) exploitation in Digest Authentication by implementing memory protection safeguards to prevent unauthorized code execution.
Scans for and identifies the presence of CVE-2025-21368 in Microsoft components, enabling proactive flaw remediation before remote exploitation occurs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote code execution vulnerability in Microsoft Digest Authentication (HTTP-based auth component, often tied to IIS/web servers) with network attack vector and no user interaction, directly enabling exploitation of public-facing applications for initial access.
NVD Description
Microsoft Digest Authentication Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21368 is a remote code execution vulnerability affecting Microsoft Digest Authentication. Published on 2025-02-11, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-122, with additional NVD-CWE-noinfo classification.
The vulnerability can be exploited by an attacker with low privileges (PR:L) over the network (AV:N), requiring low attack complexity and no user interaction. Successful exploitation enables remote code execution with high impacts on confidentiality, integrity, and availability.
Microsoft's advisory provides mitigation guidance, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21368.
Details
- CWE(s)