CVE-2025-25006

Published: Aug 12, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: secure@microsoft.com (Secondary)

Description

Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Affected (37)

Products: Microsoft: Exchange Server, Exchange Server Subscription Edition

Microsoft

2 products

Exchange Server

Exchange Server Subscription Edition

Configuration A

37 vulnerable

Vulnerable Software	Affected Versions
Microsoft Exchange Server	Version 2016
Microsoft Exchange Server	Version 2016 cumulative_update_10
Microsoft Exchange Server	Version 2016 cumulative_update_11
Microsoft Exchange Server	Version 2016 cumulative_update_12
Microsoft Exchange Server	Version 2016 cumulative_update_13
Microsoft Exchange Server	Version 2016 cumulative_update_14
Microsoft Exchange Server	Version 2016 cumulative_update_15
Microsoft Exchange Server	Version 2016 cumulative_update_16
Microsoft Exchange Server	Version 2016 cumulative_update_17
Microsoft Exchange Server	Version 2016 cumulative_update_18
Microsoft Exchange Server	Version 2016 cumulative_update_19
Microsoft Exchange Server	Version 2016 cumulative_update_1
Microsoft Exchange Server	Version 2016 cumulative_update_20
Microsoft Exchange Server	Version 2016 cumulative_update_21
Microsoft Exchange Server	Version 2016 cumulative_update_2
Microsoft Exchange Server	Version 2016 cumulative_update_3
Microsoft Exchange Server	Version 2016 cumulative_update_4
Microsoft Exchange Server	Version 2016 cumulative_update_5
Microsoft Exchange Server	Version 2016 cumulative_update_6
Microsoft Exchange Server	Version 2016 cumulative_update_7
Microsoft Exchange Server	Version 2016 cumulative_update_8
Microsoft Exchange Server	Version 2016 cumulative_update_9
Microsoft Exchange Server	Version 2019
Microsoft Exchange Server	Version 2019 cumulative_update_10
Microsoft Exchange Server	Version 2019 cumulative_update_11
Microsoft Exchange Server	Version 2019 cumulative_update_12
Microsoft Exchange Server	Version 2019 cumulative_update_13
Microsoft Exchange Server	Version 2019 cumulative_update_1
Microsoft Exchange Server	Version 2019 cumulative_update_2
Microsoft Exchange Server	Version 2019 cumulative_update_3
Microsoft Exchange Server	Version 2019 cumulative_update_4
Microsoft Exchange Server	Version 2019 cumulative_update_5
Microsoft Exchange Server	Version 2019 cumulative_update_6
Microsoft Exchange Server	Version 2019 cumulative_update_7
Microsoft Exchange Server	Version 2019 cumulative_update_8
Microsoft Exchange Server	Version 2019 cumulative_update_9
Microsoft Exchange Server Subscription Edition	Before 15.02.2562.020

Related CWEs

CWE-167

Improper Handling of Additional Special Element

The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25006

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.