CVE-2025-49730
Published: 08 July 2025
Summary
CVE-2025-49730 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 12.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-49730 is a time-of-check time-of-use (TOCTOU) race condition in the Microsoft Windows QoS scheduler. It is tracked under CWE-367 and CWE-122 and carries a CVSS 3.1 base score of 7.8 reflecting local attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
An authorized local attacker can exploit the race condition to elevate privileges on the affected Windows system, achieving arbitrary code execution or full administrative access without user interaction.
The Microsoft Security Response Center advisory recommends applying the security updates released for the QoS scheduler component to eliminate the TOCTOU window. The associated EPSS score remains flat at 0.0351 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20544
Vulnerability details
Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.