Cyber Posture

CVE-2025-47981

CriticalPublic PoC

Published: 08 July 2025

Published
08 July 2025
Modified
26 September 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0320 87.1th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47981 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires identification, reporting, and correction of the heap-based buffer overflow flaw in Windows SPNEGO Extended Negotiation through timely patching.

prevent

Implements memory safeguards such as DEP and ASLR to protect against unauthorized code execution from heap-based buffer overflow exploits in SPNEGO.

preventdetect

Scans for and remediates vulnerabilities like CVE-2025-47981 in Windows SPNEGO to identify and prioritize patching before network exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Network-accessible unauthenticated heap buffer overflow enabling RCE in Windows SPNEGO auth component directly maps to remote service/public app exploitation for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

Deeper analysisAI

CVE-2025-47981, published on 2025-07-08, is a heap-based buffer overflow vulnerability (CWE-122) in the Windows SPNEGO Extended Negotiation component. This flaw affects Windows systems that use SPNEGO for extended negotiation in authentication protocols. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

An unauthorized attacker can exploit this vulnerability over a network without privileges, user interaction, or high complexity. Successful exploitation enables remote code execution on the targeted Windows system.

Microsoft's Security Response Center (MSRC) has published an update guide detailing patches and remediation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47981. Vicarius provides a detection script at https://www.vicarius.io/vsociety/posts/cve-2025-47981-detection-script-heap-based-buffer-overflow-in-windows-spnego-extended-negotiation and a mitigation script at https://www.vicarius.io/vsociety/posts/cve-2025-47981-mitigation-script-heap-based-buffer-overflow-in-windows-spnego-extended-negotiation.

Details

CWE(s)

Affected Products

microsoft
windows 10 1507
≤ 10.0.10240.21073 · ≤ 10.0.10240.21073
microsoft
windows 10 1607
≤ 10.0.14393.8246 · ≤ 10.0.14393.8246
microsoft
windows 10 1809
≤ 10.0.17763.7558 · ≤ 10.0.17763.7558
microsoft
windows 10 21h2
≤ 10.0.19044.6093
microsoft
windows 10 22h2
≤ 10.0.19045.6093
microsoft
windows 11 22h2
≤ 10.0.22621.5624
microsoft
windows 11 23h2
≤ 10.0.22631.5624
microsoft
windows 11 24h2
≤ 10.0.26100.4652
microsoft
windows server 2008
r2
microsoft
windows server 2012
all versions, r2
+5 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-21223Same product: Microsoft Windows 10 1507
CVE-2025-21236Same product: Microsoft Windows 10 1507
CVE-2025-21200Same product: Microsoft Windows 10 1507
CVE-2025-24051Same product: Microsoft Windows 10 1507
CVE-2025-21282Same product: Microsoft Windows 10 1507
CVE-2025-21306Same product: Microsoft Windows 10 1507
CVE-2025-21286Same product: Microsoft Windows 10 1507
CVE-2025-21250Same product: Microsoft Windows 10 1507
CVE-2025-21368Same product: Microsoft Windows 10 1507
CVE-2025-21252Same product: Microsoft Windows 10 1507

References