CVE-2025-62220
Published: 11 November 2025
Summary
CVE-2025-62220 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Subsystem For Linux. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-62220 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting the Windows Subsystem for Linux GUI. Published on 2025-11-11T18:15:49.730, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An unauthorized attacker can exploit this vulnerability over a network with low attack complexity and no required privileges, though user interaction is necessary. Successful exploitation allows arbitrary code execution, granting high levels of confidentiality, integrity, and availability impact on the affected system.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62220 provides guidance on mitigations and patches for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-93423
Vulnerability details
Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The heap-based buffer overflow in Windows Subsystem for Linux GUI enables arbitrary code execution via client-side exploitation requiring user interaction (UI:R), directly mapping to T1203: Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation through application of Microsoft patches directly eliminates the heap-based buffer overflow vulnerability in Windows Subsystem for Linux GUI.
Memory protection mechanisms such as ASLR, DEP, and heap hardening prevent exploitation of the heap-based buffer overflow for arbitrary code execution.
Input validation enforces bounds checking on network inputs to the WSL GUI, mitigating the root cause of the heap-based buffer overflow.