First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-55698

HighCVSS 7.7/10Last modified Oct 18, 2026

Description

Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.6899
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.6899
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.6899
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.6899

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55698Vendor Advisory

Timeline

Published: Oct 14, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-556995.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-55705.4The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all version CVE-2025-557004.3Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networ CVE-2025-557017.8Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.CVE-2025-557028.7When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread CVE-2025-557033.3An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint th CVE-2025-557045.3Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of t CVE-2025-557059.8This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charging station ID. This CVE-2025-557065.1URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter CVE-2025-557077.2Incorrect Privilege Assignment vulnerability in WPXPO PostX ultimate-post allows Privilege Escalation.This issue affects PostX: from n/a thr CVE-2025-557088.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Ma CVE-2025-557096.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Websit

CVE-2025-55698: High severity, CVSS 7.7 | Vulnix