Remote Code Execution Vulnerability in Windows Remote Desktop Services
CVE-2025-24045

8.1HIGH

Key Information:

Vendor
Microsoft
Status
Windows Server 2019
Windows Server 2019 (server Core Installation)
Windows Server 2022
Windows Server 2025 (server Core Installation)
Vendor
CVE Published:
11 March 2025

Summary

The vulnerability in Windows Remote Desktop Services arises from sensitive data being stored in memory that is inadequately secured. This allows an unauthorized attacker to potentially execute arbitrary code across a network, posing significant risks to system security and data integrity. To mitigate this issue, it is essential for users to apply relevant security updates and follow best practices for securing remote access.

Affected Version(s)

Windows Server 2012 (Server Core installation) x64-based Systems 6.2.9200.0 < 6.2.9200.25368

Windows Server 2012 R2 (Server Core installation) x64-based Systems 6.3.9600.0 < 6.3.9600.22470

Windows Server 2012 R2 x64-based Systems 6.3.9600.0 < 6.3.9600.22470

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.