« Volver al listado

CVE-2025-48809

Estado: AnalizadaMedia (5.5)—

Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Windows 11 24h2Microsoft — Windows Server 2025

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-48809",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48809",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-08T19:18:50.262430Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Windows 11 Version 24H2",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.26100.0",
              "lessThan": "10.0.26100.4652",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "ARM64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows Server 2025",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.26100.0",
              "lessThan": "10.0.26100.4652",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows Server 2025 (Server Core installation)",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.26100.0",
              "lessThan": "10.0.26100.4652",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2025-07-08T17:15:44.410",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48809",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1037"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally."
    },
    {
      "lang": "es",
      "value": "La eliminación o modificación de código crítico para la seguridad en el kernel de Windows mediante la optimización del procesador permite que un atacante autorizado divulgue información localmente."
    }
  ],
  "lastModified": "2026-06-17T09:30:20.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
              "vulnerable": true,
              "matchCriteriaId": "28085811-3148-4142-91A6-1022BEC2EEA7",
              "versionEndExcluding": "10.0.26100.4652"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10E640FB-32AB-45B6-BC42-56CC587C0A35",
              "versionEndExcluding": "10.0.26100.4652"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}