cbcvebase.
CVE-2025-29971
published 2025-05-13

CVE-2025-29971: Out-of-bounds read in Web Threat Defense (WTD.sys) allows an unauthorized attacker to deny service over a network.

PriorityP358high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
56.98%
98.9th percentile
Out-of-bounds read in Web Threat Defense (WTD.sys) allows an unauthorized attacker to deny service over a network.

Affected

13 ranges
VendorProductVersion rangeFixed in
microsoftwindows_11_22h2< 10.0.22621.533510.0.22621.5335
microsoftwindows_11_23h2< 10.0.22631.533510.0.22631.5335
microsoftwindows_11_24h2< 10.0.26100.406110.0.26100.4061
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.533510.0.22621.5335
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.533510.0.22631.5335
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.533510.0.22631.5335
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.406110.0.26100.4061
msrcwindows_11_version_22h2_for_arm64-based_systems
msrcwindows_11_version_22h2_for_x64-based_systems
msrcwindows_11_version_23h2_for_arm64-based_systems
msrcwindows_11_version_23h2_for_x64-based_systems
msrcwindows_11_version_24h2_for_arm64-based_systems
msrcwindows_11_version_24h2_for_x64-based_systems

Detection & IOCsextracted from sources · hover to see the quote

  • Target component is WTD.sys (Web Threat Defense kernel driver); monitor for crashes or unexpected behavior in this driver as a DoS indicator
  • Exploitation vector is network-based and unauthenticated; monitor for anomalous inbound network traffic triggering WTD.sys faults or system instability
  • Microsoft rates this as 'Exploitation More Likely'; prioritize detection and patching of systems running Web Threat Defense (WTD.sys)
  • ·Customer action is required to remediate; patches are available via KB5058405, KB5058411, and KB5061258
  • ·As of publication, the vulnerability has not been publicly disclosed or exploited in the wild, but exploitation is rated 'More Likely' for the latest software release

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.