CVE-2025-48002: Windows Hyper-V Information Disclosure Vulnerability

Overview

Severity

Medium (CVSS 5.7)

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Category

Information Disclosure

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2025-Jul

Released

2025-07-08

EPSS Score

0.30% (percentile: 53.1%)

Description

Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network.

FAQ

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires that an attacker will need to first gain access to the restricted network before running an attack. What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.

Affected Products (4)

Windows

• Windows Server 2025 (Server Core installation)
• Windows 11 Version 24H2 for ARM64-based Systems
• Windows 11 Version 24H2 for x64-based Systems
• Windows Server 2025

Security Updates (1)

• 5062553

Acknowledgments

Anonymous

Revision History

• 2025-07-08: Information published.