Cyber Posture

CVE-2025-26634

High

Published: 11 March 2025

Published
11 March 2025
Modified
03 July 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0048 65.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26634 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 34.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely identification, reporting, and patching of the heap-based buffer overflow vulnerability in Windows Core Messaging to prevent privilege escalation exploitation.

prevent

Provides memory safeguards such as address space layout randomization and non-executable memory to directly counter heap-based buffer overflow attacks.

prevent

Enforces validation of inputs to the Windows Core Messaging component to prevent buffer overflows from malformed network messages leading to privilege escalation.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The heap-based buffer overflow in Windows Core Messaging directly enables remote privilege escalation from low privileges, matching T1068 Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network.

Deeper analysisAI

CVE-2025-26634 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting the Windows Core Messaging component. This flaw enables an authorized attacker to elevate privileges over a network, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), specifically allowing privilege escalation within the affected system.

The Microsoft Security Response Center provides an update guide for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26634, which details recommended mitigations and patches.

Details

CWE(s)

Affected Products

microsoft
windows 10 1507
≤ 10.0.10240.20915
microsoft
windows 10 1607
≤ 10.0.14393.7785 · ≤ 10.0.14393.7785
microsoft
windows 10 21h2
≤ 10.0.19044.5487
microsoft
windows 10 22h2
≤ 10.0.19045.5487
microsoft
windows 11 22h2
≤ 10.0.22621.4890
microsoft
windows 11 23h2
≤ 10.0.22631.4890
microsoft
windows 11 24h2
≤ 10.0.26100.3194
microsoft
windows server 2016
≤ 10.0.14393.7785
microsoft
windows server 2019
≤ 10.0.17763.6893
microsoft
windows server 2022
≤ 10.0.20348.3207
+2 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-24995Same product: Microsoft Windows 10 1507
CVE-2025-24067Same product: Microsoft Windows 10 1507
CVE-2025-21378Same product: Microsoft Windows 10 1507
CVE-2025-24066Same product: Microsoft Windows 10 1507
CVE-2025-21418Same product: Microsoft Windows 10 1607
CVE-2026-26180Same product: Microsoft Windows 10 1607
CVE-2026-20840Same product: Microsoft Windows 10 1607
CVE-2026-20922Same product: Microsoft Windows 10 1607
CVE-2026-20820Same product: Microsoft Windows 10 1607
CVE-2026-26176Same product: Microsoft Windows 10 1607

References