Vulnerability details
CVE-2025-24045
Microsoft Windows Server
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS 3.1
8.1High
Official description
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (microsoft) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Microsoft | Windows Server 2012 | 6.2.9200.0 ≤ v < 6.2.9200.25368 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 ≤ v < 6.2.9200.25368 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 ≤ v < 6.3.9600.22470 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 ≤ v < 6.3.9600.22470 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2016 | 10.0.14393.0 ≤ v < 10.0.14393.7876 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 ≤ v < 10.0.14393.7876 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2019 | 10.0.17763.0 ≤ v < 10.0.17763.7009 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 ≤ v < 10.0.17763.7009 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2022 | 10.0.20348.0 ≤ v < 10.0.20348.3328 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 ≤ v < 10.0.25398.1486 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2025 | 10.0.26100.0 ≤ v < 10.0.26100.3476 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 ≤ v < 10.0.26100.3476 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24045 vendor-advisorypatch
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-03-11
- Last updated
- 2026-02-13
- State
- Published
- Assigner (CNA)
- microsoft
Exploit prediction (EPSS)
1.33%
Probability of exploitation in 30 days
71.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-591Sensitive Data Storage in Improperly Locked Memory