CVE-2025-55232
Published: 09 September 2025
Summary
CVE-2025-55232 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Hpc Pack. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring identification, reporting, and correction of the specific deserialization flaw through timely patching.
Prevents exploitation of deserialization of untrusted data by implementing input validation mechanisms at network entry points.
Mitigates arbitrary code execution from deserialization by protecting system memory from unauthorized code execution using safeguards like DEP and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated deserialization RCE directly enables exploitation of public-facing applications.
NVD Description
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.
Deeper analysisAI
CVE-2025-55232 is a deserialization of untrusted data vulnerability (CWE-502) affecting Microsoft High Performance Compute Pack (HPC). Published on 2025-09-09, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
An unauthorized attacker can exploit this vulnerability over a network without privileges or user interaction, achieving arbitrary code execution with high confidentiality, integrity, and availability impacts.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55232 provides details on mitigation and patches.
Details
- CWE(s)