CVE-2025-48819

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent network.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-591

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-48829.8A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-488207.8Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate p CVE-2025-488217.1Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent ne CVE-2025-488228.6Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.CVE-2025-488235.9Cryptographic issues in Windows Cryptographic Services allows an unauthorized attacker to disclose information over a network.CVE-2025-488248.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2025-488252.0RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who CVE-2025-488268.8A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP r CVE-2025-488279.8vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running CVE-2025-488288.1Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By c CVE-2025-48837.2A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been declared as critical. This vulnerability affects the function ctxz_asp o CVE-2025-488396.6An Out-of-bounds Write vulnerability [CWE-787] in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versio