CVE-2025-24035
Published: 11 March 2025
Summary
CVE-2025-24035 is a high-severity Sensitive Data Storage in Improperly Locked Memory (CWE-591) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24035 is a high-severity vulnerability (CVSS 8.1) involving sensitive data storage in improperly locked memory within Windows Remote Desktop Services. Published on March 11, 2025, it stems from CWE-591 and enables an unauthorized attacker to execute code over a network by exploiting this memory handling flaw.
An attacker with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary code execution on the targeted system.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24035 provides details on patches and mitigation guidance for affected Windows Remote Desktop Services instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6365
Vulnerability details
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote code execution in Windows Remote Desktop Services over a network, directly mapping to exploitation of public-facing applications and remote services for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the memory handling flaw in Windows Remote Desktop Services by requiring timely application of vendor patches.
Implements controls to protect system memory from unauthorized access, countering the improper locking of sensitive data that enables code execution.
Controls and monitors network communications at system boundaries to restrict unauthorized remote access to the vulnerable Remote Desktop Services.