Cyber Posture

CVE-2026-25174

High

Published: 10 March 2026

Published
10 March 2026
Modified
13 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 17.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25174 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely remediation of known flaws such as this out-of-bounds read vulnerability via patching as provided by Microsoft.

prevent

Implements memory safeguards like address space layout randomization and data execution prevention to protect against out-of-bounds read exploits leading to privilege escalation.

prevent

Enforces least privilege to limit the scope and impact of local privilege escalation from low-privileged accounts.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Out-of-bounds read in Windows file allocation component directly enables local privilege escalation from low-privileged context (AV:L/PR:L) to full system access, matching T1068 Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally.

Deeper analysisAI

CVE-2026-25174 is an out-of-bounds read vulnerability, classified under CWE-125, affecting the Windows Extensible File Allocation component. Published on 2026-03-10T18:18:32.200, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw enables an authorized attacker to elevate privileges locally on vulnerable Windows systems.

A local attacker with low privileges can exploit this vulnerability through low-complexity techniques requiring no user interaction. Successful exploitation results in high impacts across confidentiality, integrity, and availability, allowing the attacker to escalate from a low-privileged account to higher privileges.

Microsoft's Security Response Center provides details on mitigation in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25174. Security practitioners should review this advisory for applicable patches and recommended actions.

Details

CWE(s)

Affected Products

microsoft
windows 10 1607
≤ 10.0.14393.8957 · ≤ 10.0.14393.8957
microsoft
windows 10 1809
≤ 10.0.17763.8511 · ≤ 10.0.17763.8511
microsoft
windows 10 21h2
≤ 10.0.19044.7058 · ≤ 10.0.19044.7058 · ≤ 10.0.19044.7058
microsoft
windows 10 22h2
≤ 10.0.19045.7058 · ≤ 10.0.19045.7058 · ≤ 10.0.19045.7058
microsoft
windows 11 23h2
≤ 10.0.22631.6783 · ≤ 10.0.22631.6783
microsoft
windows 11 24h2
≤ 10.0.26100.7979 · ≤ 10.0.26100.7979
microsoft
windows 11 25h2
≤ 10.0.26200.7979 · ≤ 10.0.26200.7979
microsoft
windows 11 26h1
≤ 10.0.28000.1719 · ≤ 10.0.28000.1719
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.8957
+4 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-23672Same product: Microsoft Windows 10 1607
CVE-2026-23673Same product: Microsoft Windows 10 1607
CVE-2026-26153Same product: Microsoft Windows 10 1809
CVE-2025-49687Same product: Microsoft Windows 10 1607
CVE-2025-48822Same product: Microsoft Windows 10 1607
CVE-2026-25175Same product: Microsoft Windows 10 1607
CVE-2026-26156Same product: Microsoft Windows 10 1607
CVE-2026-27914Same product: Microsoft Windows 10 1607
CVE-2026-27915Same product: Microsoft Windows 10 1607
CVE-2026-25165Same product: Microsoft Windows 10 1607

References