CVE-2025-49742
Published: 08 July 2025
Summary
CVE-2025-49742 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-49742 is an integer overflow or wraparound vulnerability, tracked under CWE-122 and CWE-190, that affects the Microsoft Graphics Component. The flaw carries a CVSS 3.1 base score of 7.8 and permits an attacker to execute arbitrary code on an affected system.
An authorized local attacker with low attack complexity and no user interaction required can exploit the issue to achieve full confidentiality, integrity, and availability impact on the target host.
Microsoft has published an advisory for the vulnerability at the Microsoft Security Response Center, which includes guidance on available updates. The EPSS score remains flat at 0.0112 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20536
Vulnerability details
Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.