CVE-2025-29807
Published: 21 March 2025
Summary
CVE-2025-29807 is a high-severity Code Injection (CWE-94) vulnerability in Microsoft Dataverse. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 22.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the deserialization vulnerability by requiring timely flaw remediation through patching as detailed in the MSRC advisory for CVE-2025-29807.
Prevents exploitation of untrusted data deserialization in Microsoft Dataverse by enforcing validation of all inputs prior to processing.
Mitigates remote code execution resulting from the deserialization flaw via memory protections such as non-executable memory and address space randomization.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The deserialization vulnerability in Microsoft Dataverse allows a low-privileged authenticated attacker to achieve remote code execution (CWE-94/502), directly mapping to exploitation for privilege escalation from low to high impact.
NVD Description
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
Deeper analysisAI
CVE-2025-29807 is a deserialization of untrusted data vulnerability affecting Microsoft Dataverse. Published on 2025-03-21, it is associated with CWE-94 (code injection) and CWE-502 (deserialization of untrusted data), earning a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation allows remote code execution, resulting in high impacts to confidentiality and integrity (C:H/I:H), with no impact to availability (A:N) but a changed scope (S:C).
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29807 provides details on mitigation and patches.
Details
- CWE(s)