Multiple vulnerabilities in Microsoft Windows Remote Desktop Services
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2025-24045 CVE-2025-24035 |
| CWE-ID | CWE-591 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Windows Server Operating systems & Components / Operating system Windows Operating systems & Components / Operating system |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Sensitive Data Storage in Improperly Locked Memory
EUVDB-ID: #VU105520
Risk: High
CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2025-24045
CWE-ID:
CWE-591 - Sensitive Data Storage in Improperly Locked Memory
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to sensitive data storage in improperly locked memory in Windows Remote Desktop Services. A remote attacker can execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows Server: 2012 Gold - 2025 10.0.26100.3194
CPE2.3- cpe:2.3:o:microsoft:windows_server:2012:6.2.9200.25317:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server:2016:10.0.14393.7785:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server:2019:10.0.17763.6893:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server:2022_23H2:10.0.25398.1425:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server:2025:10.0.26100.3194:*:*:*:*:*:*
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-24045
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Sensitive Data Storage in Improperly Locked Memory
EUVDB-ID: #VU105521
Risk: High
CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2025-24035
CWE-ID:
CWE-591 - Sensitive Data Storage in Improperly Locked Memory
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to sensitive data storage in improperly locked memory in Windows Remote Desktop Services. A remote attacker can execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsWindows: 10 21H2 10.0.19041.3920 - 11 24H2 10.0.26100.3194
Windows Server: 2008 R2 SP1 - 2025 10.0.26100.3194
CPE2.3- cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.5487:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:10_22H2:10.0.19045.5487:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:10_1507:10.0.10240.20915:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:10_1607:10.0.14393.7785:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:10_1809:10.0.17763.6893:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:11_22H2:10.0.22621.4890:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:11_23H2:10.0.22631.4890:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:11_24H2:10.0.26100.3194:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server:2008:6.0.6003.23117:*:*:*:*:*:*
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-24035
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
