CVE-2025-47981
Published: 08 July 2025
Summary
CVE-2025-47981 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-47981 is a heap-based buffer overflow vulnerability, tracked under CWE-122, that affects the SPNEGO Extended Negotiation component in Windows. The flaw carries a CVSS 3.1 score of 9.8 and permits remote code execution without any authentication or user interaction when the affected protocol handling occurs over a network.
An unauthenticated attacker can send specially crafted network traffic to trigger the overflow, resulting in arbitrary code execution with the privileges of the affected process. Because the attack requires no credentials and can be launched remotely, the vulnerability is exploitable by any party with network reachability to a vulnerable Windows system participating in SPNEGO negotiation.
Microsoft has published remediation guidance in its Security Response Center update guide. Third-party resources also provide detection and mitigation scripts that can be used to identify unpatched systems and apply interim controls until official updates are deployed.
EPSS scores remain low, with a current value of 0.0316 and a peak of 0.0320, indicating no material increase in observed exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20611
Vulnerability details
Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Network-accessible unauthenticated heap buffer overflow enabling RCE in Windows SPNEGO auth component directly maps to remote service/public app exploitation for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the heap-based buffer overflow flaw in Windows SPNEGO Extended Negotiation through timely patching.
Implements memory safeguards such as DEP and ASLR to protect against unauthorized code execution from heap-based buffer overflow exploits in SPNEGO.
Scans for and remediates vulnerabilities like CVE-2025-47981 in Windows SPNEGO to identify and prioritize patching before network exploitation.