CVE-2025-29842
7.5
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.6 / Impact: 5.9
Source: secure@microsoft.com (Secondary)
Description
Acceptance of extraneous untrusted data with trusted data in UrlMon allows an unauthorized attacker to bypass a security feature over a network.
Affected (23)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 10.0.10240.21014 | |
| Before 10.0.14393.8066 | |
| Before 10.0.17763.7314 | |
| Before 10.0.19044.5854 | |
| Before 10.0.19045.5854 | |
| Before 10.0.22621.5335 | |
| Before 10.0.22631.5335 | |
| Before 10.0.26100.4061 | |
| Before 10.0.14393.8066 | |
| Before 10.0.17763.7314 | |
| Before 10.0.20348.3692 | |
| Before 10.0.25398.1611 | |
| Before 10.0.26100.4061 |
Related CWEs
CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-349
Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
References (1)
Source: secure@microsoft.com
Vendor Advisory
Timeline
No history available yet.