CVE-2025-30397
Microsoft Windows Scripting Engine Type Confusion Vulnerability
Description
CVE-2025-30397 is a high-severity type confusion vulnerability in the Microsoft Scripting Engine, which powers JScript and VBScript execution in Internet Explorer and legacy Edge. The flaw allows an unauthorized remote attacker to execute arbitrary code over a network by exploiting how the scripting engine accesses resources using an incompatible type. With a CVSS v3.1 base score of 7.5, successful exploitation requires the victim to click a malicious link or visit a compromised web page while using Internet Explorer mode. CISA has added CVE-2025-30397 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 3, 2025, and its EPSS score of 21.27% at the 95th percentile signals a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.21014 |
| microsoft | windows 10 1607 | < 10.0.14393.8066 |
| microsoft | windows 10 1809 | < 10.0.17763.7314 |
| microsoft | windows 10 21h2 | < 10.0.19044.5854 |
| microsoft | windows 10 22h2 | < 10.0.19045.5854 |
| microsoft | windows 11 22h2 | < 10.0.22621.5335 |
| microsoft | windows 11 23h2 | < 10.0.22631.5335 |
| microsoft | windows 11 24h2 | < 10.0.26100.3981 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8066 |
| microsoft | windows server 2019 | < 10.0.17763.7314 |
| microsoft | windows server 2022 | < 10.0.20348.3692 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1611 |
| microsoft | windows server 2025 | < 10.0.26100.3981 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-detection-script(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-mitigation-script(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30397(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CVE-2025-30397 is classified under CWE-843, Type Confusion. In the Microsoft Scripting Engine, a resource is allocated or initialized using one type but subsequently accessed using an incompatible type. This mismatch in type assumptions causes the engine to misinterpret memory contents, enabling an attacker to read or write memory outside intended boundaries. In the scripting engine context, type confusion can corrupt object pointers or virtual function tables, allowing the attacker to redirect code execution and achieve arbitrary code execution on the victim's system.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2025-30397 carries a CVSS v3.1 base score of 7.5 (High) with a network-accessible attack vector (AV:N), high attack complexity (AC:H), no authentication required (PR:N), but user interaction required (UI:R). Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), indicating that successful exploitation leads to complete system compromise at the privilege level of the browser process. While the high attack complexity (requiring the victim to use Internet Explorer mode) and user interaction requirement somewhat limit exploitation, the impact is devastating: the attacker gains the ability to execute arbitrary code on the victim's machine. The EPSS score of 21.27% at the 95th percentile confirms a very high probability of exploitation. The vulnerability affects all supported Windows versions from Windows Server 2008 through Windows Server 2025 and Windows 11 24H2, representing an enormous attack surface. Public exploit-related resources are available from Vicarius, including detection and mitigation scripts.
Exploit Maturity
CVE-2025-30397 demonstrates significant exploit maturity. CISA has confirmed active exploitation in the wild by adding it to the Known Exploited Vulnerabilities catalog. Public exploit-related resources are available via Vicarius, including a detection script and a mitigation script. The EPSS score of 21.27% at the 95th percentile indicates very high exploitation activity. Type confusion vulnerabilities in scripting engines have been a favored attack vector for advanced threat actors, as they reliably enable remote code execution through browser-based attacks, particularly in targeted spear-phishing campaigns that lure victims to malicious web pages.
Remediation
- Apply Microsoft security updates immediately. Install the May 2025 cumulative updates for all affected Windows versions. Refer to the Microsoft Security Response Center advisory for specific KB articles.
- Disable Internet Explorer mode where possible. If business requirements do not mandate Internet Explorer mode in Microsoft Edge, disable it to eliminate the attack surface for this scripting engine vulnerability.
- Restrict JScript and VBScript execution. Configure Group Policy to disable or restrict active scripting in Internet Explorer security zones. Set the Internet Zone to disable Active Scripting to prevent exploitation through malicious web pages.
- Deploy web content filtering. Configure proxy servers and secure web gateways to block access to known malicious domains and filter suspicious JavaScript/VBScript content. Implement URL reputation checking to prevent users from reaching exploit delivery pages.
- Educate users about phishing risks. Since exploitation requires user interaction (clicking a link or visiting a page), security awareness training that focuses on recognizing and avoiding malicious links is an important defense layer.
Technical Details
CVE-2025-30397 is a type confusion vulnerability in the Microsoft Scripting Engine (jscript.dll). The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-accessible attack with high complexity, no privileges required, user interaction required, unchanged scope, and maximum impact across all CIA dimensions.
The vulnerability arises when the scripting engine incorrectly accesses a resource using an incompatible type. During JavaScript or VBScript execution, the engine manages objects with associated type information. A crafted script can trigger a condition where the engine stores a value as one type but later accesses it assuming a different type, causing the engine to misinterpret the memory layout. This CWE-843 type confusion can result in the engine treating a user-controlled value as a pointer, or misinterpreting object metadata, enabling the attacker to corrupt adjacent memory structures. By carefully crafting the type confusion, an attacker can overwrite function pointers or virtual table entries to redirect execution to attacker-controlled code. The high attack complexity reflects the requirement for the victim to use Internet Explorer mode and visit a specific malicious page.
Frequently Asked Questions
Is CVE-2025-30397 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-30397 to the KEV catalog. The EPSS score of 21.27% at the 95th percentile indicates very high exploitation probability. Public detection and mitigation scripts are available from Vicarius.
What products are affected by CVE-2025-30397?
All supported Windows versions are affected, including Windows 10 (1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008 through Windows Server 2025. The vulnerability is in the Microsoft Scripting Engine used by Internet Explorer mode.
How do I fix CVE-2025-30397?
Apply the May 2025 cumulative Microsoft security updates. Additionally, disable Internet Explorer mode if not required, restrict Active Scripting in Internet Explorer security zones, and deploy web content filtering to block access to exploit delivery pages.
How severe is CVE-2025-30397?
CVE-2025-30397 has a CVSS v3.1 base score of 7.5 (High) with maximum impact on confidentiality, integrity, and availability. While the high attack complexity somewhat limits exploitation, the EPSS score of 21.27% at the 95th percentile and confirmed KEV status demonstrate that attackers are successfully exploiting this vulnerability in targeted attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.