CVE-2025-24035
HIGHDescription
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS v3.1 Score
8.1
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type (CWE)
CWE-591
CWE-591
Affected Products
| Vendor | Product |
|---|---|
| microsoft | windows_10_1507 |
| microsoft | windows_10_1507 |
| microsoft | windows_10_1607 |
| microsoft | windows_10_1607 |
| microsoft | windows_10_1809 |
| microsoft | windows_10_1809 |
| microsoft | windows_10_21h2 |
| microsoft | windows_10_22h2 |
| microsoft | windows_11_22h2 |
| microsoft | windows_11_23h2 |
| microsoft | windows_11_24h2 |
| microsoft | windows_server_2008 |
| microsoft | windows_server_2008 |
| microsoft | windows_server_2008 |
| microsoft | windows_server_2012 |
| microsoft | windows_server_2012 |
| microsoft | windows_server_2016 |
| microsoft | windows_server_2019 |
| microsoft | windows_server_2022 |
| microsoft | windows_server_2022_23h2 |
| microsoft | windows_server_2025 |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2025-24035? +
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. It has a CVSS v3.1 base score of 8.1 (HIGH).
How severe is CVE-2025-24035? +
CVE-2025-24035 has a CVSS v3.1 score of 8.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2025-24035? +
CVE-2025-24035 affects products from microsoft, specifically: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2025-24035? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.
Related Vulnerabilities
CVE-2024-38131
8.8
Clipboard Virtual Channel Extension Remote Code Execution Vulnerability
CVE-2025-24045
8.1
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over …
CVE-2025-21309
8.1
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVE-2025-21224
8.1
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
CVE-2025-21294
8.1
Microsoft Digest Authentication Remote Code Execution Vulnerability
CVE-2025-26671
8.1
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.