CVE-2025-49761
published 2025-08-12CVE-2025-49761: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
PriorityP345high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.43%
35.1th percentile
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Affected
59 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.21100 | 10.0.10240.21100 |
| microsoft | windows_10_1607 | < 10.0.14393.8330 | 10.0.14393.8330 |
| microsoft | windows_10_1809 | < 10.0.17763.7678 | 10.0.17763.7678 |
| microsoft | windows_10_21h2 | < 10.0.19044.6216 | 10.0.19044.6216 |
| microsoft | windows_10_22h2 | < 10.0.19045.6216 | 10.0.19045.6216 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.21100 | 10.0.10240.21100 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.8330 | 10.0.14393.8330 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7678 | 10.0.17763.7678 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.6216 | 10.0.19044.6216 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.6216 | 10.0.19045.6216 |
| microsoft | windows_11_22h2 | < 10.0.22621.5768 | 10.0.22621.5768 |
| microsoft | windows_11_23h2 | < 10.0.22631.5768 | 10.0.22631.5768 |
| microsoft | windows_11_24h2 | < 10.0.26100.4851 | 10.0.26100.4851 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5768 | 10.0.22621.5768 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5768 | 10.0.22631.5768 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5768 | 10.0.22631.5768 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.4946 | 10.0.26100.4946 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27872 | 6.1.7601.27872 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25622 | 6.2.9200.25622 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22725 | 6.3.9600.22725 |
| microsoft | windows_server_2016 | < 10.0.14393.8330 | 10.0.14393.8330 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.8330 | 10.0.14393.8330 |
| microsoft | windows_server_2019 | < 10.0.17763.7678 | 10.0.17763.7678 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hhxj-vxv9-cx4f: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally
ghsa_unreviewed·2025-08-12
CVE-2025-49761 [HIGH] CWE-416 GHSA-hhxj-vxv9-cx4f: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
GHSA
REXML ReDoS vulnerability
ghsa·2024-10-28
CVE-2024-49761 [MEDIUM] CWE-1333 REXML ReDoS vulnerability
REXML ReDoS vulnerability
### Impact
The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
### Patches
The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
### Workarounds
Use Ruby 3.2 or later instead of Ruby 3.1.
### References
* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org
Red Hat
rexml: REXML: Denial of Service via inefficient regex parsing
vendor_redhat·2025-09-25·CVSS 6.6
CVE-2025-10990 [MEDIUM] CWE-1333 rexml: REXML: Denial of Service via inefficient regex parsing
rexml: REXML: Denial of Service via inefficient regex parsing
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-497
Microsoft
Windows Kernel Elevation of Privilege Vulnerability
vendor_msrc·2025-08-12·CVSS 7.8
CVE-2025-49761 [HIGH] CWE-416 Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
Description: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Windows Kernel: Windows Kernel
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5063877
Reference: https://support.microsoft.com/help/5063877
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5063880
Reference: https://
Microsoft
REXML ReDoS vulnerability
vendor_msrc·2024-10-08·CVSS 7.5
CVE-2024-49761 [MEDIUM] CWE-1333 REXML ReDoS vulnerability
REXML ReDoS vulnerability
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azu
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
blogs_bleepingcomputer·2025-08-12·CVSS 7.2
[HIGH] Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
## Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws
## Lawrence Abrams
44 Elevation of Privilege Vulnerabilities
35 Remote Code Execution Vulnerabilities
18 Information Disclosure Vulnerabilities
4 Denial of Service Vulnerabilities
9 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released on Patch Tuesday. Therefore, the number of flaws does not include Mariner, Azure, and Microsoft Edge bugs fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5063878 & KB5063875 cumulative updates and the Windows 10 KB5063709 cumulative update .
## One publicly disclosed zero-day fixed
This month's Patch Tuesday fixes one
HackerOne
CVE-2024-49761: ReDoS vulnerability in REXML
hackerone·2024-11-30·CVSS 7.5
CVE-2024-49761 [HIGH] CVE-2024-49761: ReDoS vulnerability in REXML
CVE-2024-49761: ReDoS vulnerability in REXML
Hi,
When [REXML](https://github.com/ruby/rexml) is used to parse an XML that has many digits between `&#` and `x...;` in a hex numeric character reference `(&#x...;)` may lead to ReDos.
Advisory: https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/
## Impact
Reduced performance or Denial of Service was possible where REXML is used to parse user input.
###CVE-2024-49761: ReDoS vulnerability in REXML
There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-49761. We strongly recommend upgrading the REXML gem.
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
###Details
When parsing
2025-08-12
Published