CVE-2025-29808: Windows Cryptographic Services Information Disclosure Vulnerability

Overview

Severity

Medium (CVSS 5.5)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Information Disclosure

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2025-Apr

Released

2025-04-08

EPSS Score

0.42% (percentile: 62.1%)

Description

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

FAQ

What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

Affected Products (2)

Windows

• Windows Server 2022
• Windows Server 2022 (Server Core installation)

Security Updates (1)

• 5055526

Revision History

• 2025-04-08: Information published.