CVE-2025-50172

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.7678
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.6216
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.6216
MicrosoftWindows 11 version 22H2>= 10.0.22621.0, < 10.0.22621.5768
MicrosoftWindows 11 version 22H3>= 10.0.22631.0, < 10.0.22631.5768
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.5768
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.4946
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.7678
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.7678
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.4052
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.1791
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.4946
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.4946

References

Timeline

Published
Aug 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-501737.8Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2025-501747.0Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.CVE-2025-501757.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-501767.8Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally.CVE-2025-501778.1Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.CVE-2025-501786.6GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided valuesCVE-2025-501794.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request CVE-2025-50187.1The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on theCVE-2025-501807.5esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowCVE-2025-501816.1urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiaCVE-2025-501826.1urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects CVE-2025-501836.5OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature o