EXPOSURES › CVE-2025-30400
CVE-2025-30400
HIGH ⌖ ON CISA KEV · EXPLOITEDA use-after-free vulnerability in the Windows DWM Core Library allows local privilege escalation and is currently being exploited in the wild.
This CVE allows an attacker with local access to elevate privileges, potentially leading to unauthorized access and data compromise. DIB organizations using Windows must promptly patch to mitigate this risk and maintain CMMC/NIST 800-171 compliance. Failure to patch exposes systems to exploitation and potential regulatory penalties.
Shame score — The vulnerability's active exploitation indicates a failure in Microsoft's security practices and a potential risk to DIB partners.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |