CVE-2025-49682 is a use-after-free vulnerability in Windows Media affecting various versions of Windows 10, 11, and Server. This high-severity flaw (CVSS 7.3) allows an authorized, local attacker to achieve privilege escalation, with high impacts on confidentiality, integrity, and availability. While it has not been observed in active exploitation and no public exploit code is available, it garnered minimal community discussion and media coverage, appearing in a Microsoft Patch Tuesday article.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.0.19044.6093CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* | ||
< 10.0.19045.6093CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* | ||
< 10.0.22621.5624CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* | ||
< 10.0.22631.5624CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* | ||
< 10.0.26100.4652CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.