Use After Free Vulnerability in Microsoft's Inbox COM Objects
CVE-2025-58738

7HIGH

Key Information:

Vendor

Microsoft
Status
Windows 11 Version 25h2
Windows 10 Version 1809
Windows Server 2019
Windows Server 2019 (server Core Installation)
Vendor
CVE Published:
14 October 2025

What is CVE-2025-58738?

The use after free vulnerability in Microsoft's Inbox COM Objects can potentially be exploited by unauthorized attackers to execute arbitrary code locally. When specific conditions are met, this vulnerability may allow attackers to gain unauthorized access to sensitive data and system resources, putting users at risk.

Affected Version(s)

Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.21161

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.7919

Windows 10 Version 21H2 32-bit Systems 10.0.19044.0 < 10.0.19044.6456

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-58738 : Use After Free Vulnerability in Microsoft's Inbox COM Objects