Cyber Resilience

CVE-2025-64657

Critical

Published: 26 November 2025

Published
26 November 2025
Modified
13 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-64657 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Microsoft Azure Application Gateway. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-64657 is a stack-based buffer overflow vulnerability, classified under CWE-787, affecting Azure Application Gateway. Published on 2025-11-26T01:16:07.747, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

The vulnerability enables an unauthorized attacker to exploit it remotely over a network without requiring privileges, user interaction, or high complexity. Successful exploitation allows the attacker to elevate privileges, resulting in high confidentiality, integrity, and availability impacts.

Microsoft has published an update guide detailing the vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64657, which security practitioners should consult for mitigation and patching guidance.

EU & UK References

Vulnerability details

Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.

CWE(s)
CWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

CVE-2025-64657 is a critical remote buffer overflow in public-facing Azure Application Gateway (T1190: Exploit Public-Facing Application), enabling unauthenticated RCE and privilege escalation (T1068: Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-64656Same product: Microsoft Azure Application Gateway
CVE-2026-26150Same vendor: Microsoft
CVE-2026-41613Same vendor: Microsoft
CVE-2025-26683Same vendor: Microsoft
CVE-2026-21227Same vendor: Microsoft
CVE-2025-24989Same vendor: Microsoft
CVE-2026-40365Same vendor: Microsoft
CVE-2026-21236Same vendor: Microsoft
CVE-2026-21245Same vendor: Microsoft
CVE-2026-32186Same vendor: Microsoft

Affected Assets

microsoft
azure application gateway
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the stack-based buffer overflow vulnerability in Azure Application Gateway through timely patching as detailed in Microsoft's update guide.

SI-16 Memory Protection good match
prevent

Provides memory protections such as stack canaries, DEP, and ASLR to block exploitation of the stack-based buffer overflow leading to privilege escalation.

SI-10 Information Input Validation partial match
prevent

Validates network inputs to Azure Application Gateway to restrict oversized or malformed data that could trigger the buffer overflow.

References