CVE-2025-49683

Deeper analysis

CVE-2025-49683 is an integer overflow or wraparound vulnerability, also associated with heap-based buffer overflow conditions, that affects the Virtual Hard Disk (VHDX) format handler. The flaw resides in Microsoft’s VHDX implementation and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low attack complexity, no privileges required, and required user interaction.

An unauthorized local attacker can exploit the issue by supplying a malicious VHDX file that triggers the integer overflow during processing. Successful exploitation grants the ability to execute arbitrary code on the affected system with the same privileges as the process handling the file, potentially resulting in full confidentiality, integrity, and availability impact.

Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49683 supplies official guidance and remediation details for the vulnerability. The associated EPSS score remains low and unchanged at 0.0169, indicating no material increase in observed exploitation interest since disclosure.