CVE-2025-49743

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-497447.0Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2025-497455.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unaut CVE-2025-497468.8Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.CVE-2025-497478.8Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.CVE-2025-49754.8When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full ac CVE-2025-497516.8Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.CVE-2025-4975210.0Azure Bastion Elevation of Privilege Vulnerability CVE-2025-497538.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2025-497554.3User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoof CVE-2025-497563.3Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature loc CVE-2025-497578.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2025-497588.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate