CVE-2025-26644
Microsoft Windows 10 1809 ≤ 10.0.17763.7136
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2025-26644 is a medium-severity Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism (CWE-1039) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 5.1 (Medium).
Operationally, ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10237
Vulnerability Data
Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.
- CWE(s)
Related Threats
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can specifically exercise the recognition mechanism against adversarial examples to surface the weakness.
Input validation can reject or sanitize perturbed inputs before they reach the recognition mechanism.
System monitoring can observe anomalous classifications or input patterns indicative of adversarial perturbations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring runtime data and inputs directly supports detection of adversarial perturbations to recognition mechanisms.
Secure SDLC practices include robustness testing and adversarial-input handling during model development.
Recording this class of ML vulnerability is a prerequisite for subsequent mitigation.
Explicit identification of adversarial ML threats informs the need to address this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can explicitly cover adversarial input testing for recognition mechanisms.
Threat intelligence can surface adversarial ML attack patterns but does not implement technical controls.
Secure development lifecycle requires adversarial testing and robustness validation for ML-based recognition components.
Application security requirements can mandate detection and handling of adversarial perturbations in automated recognition systems.
Secure architecture principles include resilience against input manipulation and adversarial ML attacks.
Secure coding practices can incorporate input sanitization and adversarial robustness checks for ML models.