Time-of-Check Time-of-Use Vulnerability in Microsoft Windows Virtual Machine Bus
CVE-2025-29833

7.7HIGH

Key Information:

Vendor

Microsoft
Status
Windows 10 Version 1809
Windows Server 2019
Windows Server 2019 (server Core Installation)
Windows Server 2022
Vendor
CVE Published:
13 May 2025
đź”” Create Microsoft Vulnerability Alert

What is CVE-2025-29833?

A time-of-check time-of-use (TOCTOU) race condition exists within the Microsoft Windows Virtual Machine Bus. This vulnerability allows an authorized attacker to exploit the conditions between checking system states and executing code, potentially leading to unauthorized code execution over a network. By leveraging this race condition, attackers can manipulate instances without detection, significantly impacting system integrity and security.

Affected Version(s)

Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.21014

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.8066

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.7314

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-29833 : Time-of-Check Time-of-Use Vulnerability in Microsoft Windows Virtual Machine Bus