CVE-2025-59200

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Weakness enumeration

CWE-73 CWE-362

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1507	>= 10.0.10240.0, < 10.0.10240.21161
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.8519
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.7919
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.6456
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.6456
Microsoft	Windows 11 version 22H2	>= 10.0.22621.0, < 10.0.22621.6060
Microsoft	Windows 11 version 22H3	>= 10.0.22631.0, < 10.0.22631.6060
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.6060
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.6899
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.6899
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.8519
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.8519
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.7919
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.7919
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4294
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.1913
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.6899
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.6899

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59200Vendor Advisory

Timeline

Published: Oct 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-592017.8Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.CVE-2025-592027.0Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2025-592035.5Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locall CVE-2025-592045.5Use of uninitialized resource in Windows Management Services allows an authorized attacker to disclose information locally.CVE-2025-592057.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an author CVE-2025-592067.4Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability CVE-2025-592077.8Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-592087.1Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network.CVE-2025-592095.5Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose infor CVE-2025-59215.8The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re CVE-2025-592107.4Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability CVE-2025-592115.5Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose infor