CVE-2025-53810

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1507>= 10.0.10240.0, < 10.0.10240.21128
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.8422
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.7792
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.6332
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.6332
MicrosoftWindows 11 version 22H2>= 10.0.22621.0, < 10.0.22621.5909
MicrosoftWindows 11 version 22H3>= 10.0.22631.0, < 10.0.22631.5909
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.5909
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.6584
MicrosoftWindows Server 2008 R2 Service Pack 1>= 6.1.7601.0, < 6.1.7601.27929
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)>= 6.1.7601.0, < 6.1.7601.27929
MicrosoftWindows Server 2008 Service Pack 2>= 6.0.6003.0, < 6.0.6003.23529
MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)>= 6.0.6003.0, < 6.0.6003.23529
MicrosoftWindows Server 2012>= 6.2.9200.0, < 6.2.9200.25675
MicrosoftWindows Server 2012 (Server Core installation)>= 6.2.9200.0, < 6.2.9200.25675
MicrosoftWindows Server 2012 R2>= 6.3.9600.0, < 6.3.9600.22774
MicrosoftWindows Server 2012 R2 (Server Core installation)>= 6.3.9600.0, < 6.3.9600.22774
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.8422
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.8422
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.7792
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.7792
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.4171
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.1849
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.6584
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.6584

References

Timeline

Published
Sep 9, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-538114.8The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execuCVE-2025-538134.8The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute CVE-2025-538147.8A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .xml file cCVE-2025-538167.57-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption andCVE-2025-538177.57-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pCVE-2025-538188.9GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM tasCVE-2025-538197.9Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), inCVE-2025-53826.8Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to rCVE-2025-538206.1WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XCVE-2025-538216.1WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exisCVE-2025-538226.1WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XCVE-2025-538238.8WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Versions prior to 3.4.5 have a SQL
CVE-2025-53810: Medium severity, CVSS 6.7 | Vulnix