Cyber Resilience

CVE-2025-29809

High

Published: 08 April 2025

Published
08 April 2025
Modified
10 July 2025
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0088 75.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29809 is a high-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.1 (High).

Operationally, ranked in the top 24.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-29809 is an insecure storage of sensitive information vulnerability in the Windows Kerberos component. It is tracked under CWE-922 and carries a CVSS 3.1 base score of 7.1, reflecting local attack vector, low attack complexity, and low privileges required.

An authorized local attacker can exploit the flaw to bypass a security feature, resulting in high impact to confidentiality and integrity while leaving availability unaffected. No user interaction is needed for successful exploitation.

Microsoft has published an advisory for CVE-2025-29809 that includes mitigation guidance. The current EPSS score of 0.0088 and peak of 0.0140 do not indicate a material rise warranting renewed attention.

EU & UK References

Vulnerability details

Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.20978 · ≤ 10.0.10240.20978
microsoft
windows 10 1607
≤ 10.0.14393.7969 · ≤ 10.0.14393.7969
microsoft
windows 10 1809
≤ 10.0.17763.7136 · ≤ 10.0.17763.7136
microsoft
windows 10 21h2
≤ 10.0.19044.5737
microsoft
windows 10 22h2
≤ 10.0.19045.5737
microsoft
windows 11 22h2
≤ 10.0.22621.5189
microsoft
windows 11 23h2
≤ 10.0.22631.5189
microsoft
windows 11 24h2
≤ 10.0.26100.3775
microsoft
windows server 2016
≤ 10.0.14393.7969
microsoft
windows server 2019
≤ 10.0.17763.7136
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-922

Tracking information locations and access supports secure storage practices instead of insecure ones.

addresses: CWE-922

Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.

addresses: CWE-922

Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.

addresses: CWE-922

Policy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.

addresses: CWE-922

Proper categorization drives selection of storage controls that keep sensitive information from being stored insecurely.

addresses: CWE-922

The control explicitly requires secure storage mechanisms for sensitive information, closing the insecure-storage weakness class.

addresses: CWE-922

Storing information as fragments on distinct components is an architectural control that avoids insecure single-location storage of the complete sensitive data set.

addresses: CWE-922

OPSEC requirements improve handling and storage practices for sensitive supply-chain information.

References