CVE-2025-30400

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.7314
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.5854
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.5854
Microsoft	Windows 11 version 22H2	>= 10.0.22621.0, < 10.0.22621.5335
Microsoft	Windows 11 version 22H3	>= 10.0.22631.0, < 10.0.22631.5335
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.5335
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.4061
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.7314
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.7314
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.3692
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.1611
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.4061
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.4061

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30400Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-30400US Government Resource

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: May 13, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-304016.7A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file CVE-2025-304028.1A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code exec CVE-2025-304038.1A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst ve CVE-2025-304049.8An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execu CVE-2025-304059.8An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, po CVE-2025-304069.8Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal'CVE-2025-304076.3Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (CVE-2025-304086.7Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2025-304095.5Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Win CVE-2025-30419.8A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the CVE-2025-304109.8Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud A CVE-2025-3041110.0Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Li