CVE-2025-60724
Published: 11 November 2025
Summary
CVE-2025-60724 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-60724 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting the Microsoft Graphics Component. Published on 2025-11-11T18:15:41.060, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
The vulnerability enables an unauthorized attacker to execute arbitrary code over a network. Exploitation requires low complexity, no user privileges, no user interaction, and network access, allowing remote attackers to achieve high-impact effects on confidentiality, integrity, and availability, such as full system compromise.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60724.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-93409
Vulnerability details
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a critical remote code execution (RCE) in the Microsoft Graphics Component with AV:N/AC:L/PR:N/UI:N, directly enabling exploitation of a public-facing application over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires organizations to identify, report, and correct flaws like this heap-based buffer overflow through timely application of vendor patches from Microsoft.
Implements memory protection mechanisms such as ASLR, DEP, and heap cookies that directly mitigate exploitation of heap buffer overflows for arbitrary code execution.
Mandates validation of inputs to the Microsoft Graphics Component to detect and reject malformed data that could trigger the buffer overflow over the network.