CVE-2025-27472: Windows Mark of the Web Security Feature Bypass Vulnerability

CVE-2025-27472 is a security feature bypass vulnerability in Windows Mark of the Web, rated Important by Microsoft, with a CVSS 3.1 base score of 5.4 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 1.52% probability of exploitation activity in the next 30 days, higher than 75% of all scored vulnerabilities. Microsoft released the fix on 7 April 2025 in the April 2025 Patch Tuesday, delivered through 3 security updates (KB5055547, KB5055581, KB5055557). It affects 6 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2025-27472
Severity: Medium CVSS 5.4
Microsoft severity: Important
Impact: Security Feature Bypass
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: More Likely
Weakness: CWE-693
EPSS: 1.52% (percentile 75%)
CISA KEV: Not listed
Released: 7 April 2025
Last updated: 8 April 2025
Patch Tuesday: April 2025 Patch Tuesday
Product families: Windows, ESU

CVSS score and vector

Microsoft scores CVE-2025-27472 at 5.4 (temporal 4.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	None
Integrity impact	Low
Availability impact	Low
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.

Frequently asked questions (Microsoft)

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of integrity (I:L) and some loss of availability (A:L). What does that mean for this vulnerability?

An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt.

How could an attacker exploit the vulnerability?

To exploit this vulnerability, an attacker could host a file on an attacker-controlled server, then convince a targeted user to download and open the file. This could allow the attacker to interfere with the Mark of the Web functionality.

Please see Additional information about Mark of the Web for further clarification

Are the updates for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems currently available?

Yes. As of April 9, 2025, the security update (5055547) for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems are available. Customers running Windows 10 should ensure the update is installed to be protected from this vulnerability.

Affected products (6)

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 for 32-bit Systems	KB5055547	Security Update	10.0.10240.20978	Yes
Windows 10 for x64-based Systems	KB5055547	Security Update	10.0.10240.20978	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows Server 2012	KB5055581	Monthly Rollup	6.2.9200.25423	Yes
Windows Server 2012 (Server Core installation)	KB5055581	Monthly Rollup	6.2.9200.25423	Yes
Windows Server 2012 R2	KB5055557	Monthly Rollup	6.3.9600.22523	Yes
Windows Server 2012 R2 (Server Core installation)	KB5055557	Monthly Rollup	6.3.9600.22523	Yes

Security updates (3)

KB5055547 (Security Update)
KB5055581 (Monthly Rollup)
KB5055557 (Monthly Rollup)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 5.4 (MEDIUM)
NVD weakness: CWE-693
Published to NVD: 8 April 2025
NVD last modified: 8 July 2025

Affected configurations (CPE)

Product	Vulnerable versions
windows 10 1507 (x64)	before 10.0.10240.20978
windows 10 1507 (x86)	before 10.0.10240.20978
windows server 2012	all listed versions
windows server 2012 r2	all listed versions

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27472 (Vendor Advisory)

Acknowledgments

Blaz Satler with 0patch by ACROS Security

Revision history

Version	Date	Description
1.0	7 April 2025	Information published.
2.0	8 April 2025	The security updates for Windows 10 for 32-bit Systems and Windows 10 for x64-based Systems are now available. See the Security Updates table for more information.