CVE-2025-30400
Microsoft Windows DWM Core Library Use-After-Free Vulnerability
Description
CVE-2025-30400 is a high-severity use-after-free vulnerability in the Microsoft Windows Desktop Window Manager (DWM) that allows an authorized attacker to escalate privileges locally. The flaw enables a user with low-level access to gain SYSTEM-level privileges by exploiting a memory corruption condition in the DWM service. With a CVSS v3.1 base score of 7.8, this vulnerability affects Windows 10, Windows 11, and Windows Server editions from 2019 onward. CISA has included CVE-2025-30400 in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 3, 2025, and its EPSS score of 0.83% at the 74th percentile reflects notable exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.7314 |
| microsoft | windows 10 21h2 | < 10.0.19044.5854 |
| microsoft | windows 10 22h2 | < 10.0.19045.5854 |
| microsoft | windows 11 22h2 | < 10.0.22621.5335 |
| microsoft | windows 11 23h2 | < 10.0.22631.5335 |
| microsoft | windows 11 24h2 | < 10.0.26100.3981 |
| microsoft | windows server 2019 | < 10.0.17763.7314 |
| microsoft | windows server 2022 | < 10.0.20348.3692 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1611 |
| microsoft | windows server 2025 | < 10.0.26100.3981 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30400(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30400(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2025-30400 falls under CWE-416, Use After Free, a memory safety weakness where software references memory after it has been deallocated. In the Windows Desktop Window Manager, a memory object used during graphical composition operations is freed but subsequently accessed, creating an opportunity for an attacker to corrupt memory and redirect execution to gain elevated privileges.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2025-30400 carries a CVSS v3.1 score of 7.8 (High), representing significant local impact. The attack is locally exploitable (AV:L) with low complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N). Successful exploitation results in high impact to confidentiality, integrity, and availability within the scope of the affected system (S:U). DWM runs as a SYSTEM-level service responsible for desktop composition and rendering on Windows, meaning exploitation grants the attacker full SYSTEM privileges. This allows complete access to all files and credentials on the system, the ability to install persistent backdoors, disable security software, and take full administrative control. The affected product range includes Windows 10 (1809 and later), Windows 11 (all versions), and Windows Server 2019 through 2025, covering the majority of enterprise Windows deployments. The confirmed active exploitation and EPSS score at the 74th percentile underscore the urgency of remediation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-30400 in the wild, adding it to the Known Exploited Vulnerabilities catalog on May 13, 2025, with a mandatory remediation deadline of June 3, 2025. No tagged public exploit code appears in the NVD references for this vulnerability, but the confirmed in-the-wild exploitation indicates that working exploits exist in attacker toolkits. The EPSS score of 0.83% at the 74th percentile indicates above-average exploitation probability. DWM has been targeted by privilege escalation exploits in prior campaigns, and use-after-free vulnerabilities in graphics subsystem components are a well-established exploitation technique for achieving kernel or SYSTEM-level code execution on Windows.
Remediation
-
Install the May 2025 Patch Tuesday security updates for all affected Windows systems. Consult the Microsoft Security Response Center advisory for version-specific KB articles. CISA mandates remediation by June 3, 2025.
-
Patch all in-scope Windows editions, including Windows 10 1809 (below 10.0.17763.7314), Windows 10 21H2 and 22H2, Windows 11 22H2, 23H2, and 24H2, and Windows Server 2019, 2022, 2022 23H2, and 2025, each below their respective fixed build numbers.
-
Limit local interactive logon privileges on servers and critical workstations. Since exploitation requires local access with low privileges, reducing the number of users who can log on locally narrows the attack surface.
-
Deploy endpoint detection rules that monitor for DWM exploitation patterns, including anomalous child processes spawned by dwm.exe, unexpected SYSTEM-context process creation, and memory manipulation indicators associated with use-after-free attacks.
-
Implement defense-in-depth controls such as Windows Defender Exploit Guard, Credential Guard, and strict application control policies to contain the impact if privilege escalation occurs despite patching delays.
Technical Details
CVE-2025-30400 is a use-after-free (CWE-416) vulnerability in the Windows Desktop Window Manager (DWM), the compositor service responsible for rendering the Windows desktop and managing visual effects. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a locally exploitable flaw with low complexity and privilege requirements, resulting in complete CIA compromise. DWM operates as a SYSTEM-level process (dwm.exe) and handles complex graphical object management, including surface allocation, texture composition, and visual effect processing. The vulnerability occurs when a memory object involved in these operations is freed but a reference to it persists, creating a dangling pointer. When the DWM subsequently accesses this pointer, an attacker who has reclaimed the freed memory with controlled data can hijack execution flow. The affected versions span Windows 10 1809 through Windows 11 24H2 and Windows Server 2019 through 2025, but do not include older Windows 10 versions (1507, 1607) or Windows Server 2008/2012, suggesting the vulnerable code path was introduced in a specific DWM iteration.
Frequently Asked Questions
Is CVE-2025-30400 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-30400 by listing it in the Known Exploited Vulnerabilities catalog on May 13, 2025. Organizations should treat this as an urgent patching priority.
What products are affected by CVE-2025-30400?
CVE-2025-30400 affects Windows 10 version 1809 and later, Windows 11 22H2, 23H2, and 24H2, and Windows Server 2019, 2022, 2022 23H2, and 2025. Older Windows 10 versions (1507, 1607) and Windows Server 2008/2012 are not affected.
How do I fix CVE-2025-30400?
Apply the May 2025 Patch Tuesday security updates from Microsoft. Each affected Windows version has a specific build number that includes the fix. Refer to the Microsoft Security Response Center advisory for download links and installation guidance.
How severe is CVE-2025-30400?
With a CVSS v3.1 score of 7.8 (High), CVE-2025-30400 enables full system compromise through privilege escalation to SYSTEM. The EPSS score at the 74th percentile and confirmed active exploitation indicate this is a significant and actively targeted vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.