Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-21228: Malicious code can run with elevated Windows Media permissions

CVE-2025-21228 · published 1 year ago

Summary

A vulnerability in how Windows Digital Media handles processes can let an attacker run code with extra permissions. This could allow a hacker to access and control sensitive media files stored on a Windows system, or even gain control of the entire system. To mitigate this risk, apply the latest Windows updates.

What to do

Update microsoft windows_10_1507 to version 10.0.10240.20890 or later.
Update microsoft windows_10_1607 to version 10.0.14393.7699 or later.
Update microsoft windows_10_1809 to version 10.0.17763.6775 or later.
Update microsoft windows_10_21h2 to version 10.0.19044.5371 or later.
Update microsoft windows_10_22h2 to version 10.0.19045.5371 or later.
Update microsoft windows_11_22h2 to version 10.0.22621.4751 or later.
Update microsoft windows_11_23h2 to version 10.0.22631.4751 or later.
Update microsoft windows_11_24h2 to version 10.0.26100.2894 or later.
Update microsoft windows_server_2016 to version 10.0.14393.7699 or later.
Update microsoft windows_server_2019 to version 10.0.17763.6775 or later.
Update microsoft windows_server_2022 to version 10.0.20348.3091 or later.
Update microsoft windows_server_2022_23h2 to version 10.0.25398.1369 or later.
Update microsoft windows_server_2025 to version 10.0.26100.2894 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows_10_1507	< 10.0.10240.20890 `cpe:2.3:o:microsoft:windows_10_1507:::::::x64:*`
microsoft	windows_10_1607	< 10.0.14393.7699 `cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*`
microsoft	windows_10_1809	< 10.0.17763.6775 `cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*`
microsoft	windows_10_21h2	< 10.0.19044.5371 `cpe:2.3:o:microsoft:windows_10_21h2::::::::`
microsoft	windows_10_22h2	< 10.0.19045.5371 `cpe:2.3:o:microsoft:windows_10_22h2::::::::`
microsoft	windows_11_22h2	< 10.0.22621.4751 `cpe:2.3:o:microsoft:windows_11_22h2::::::::`
microsoft	windows_11_23h2	< 10.0.22631.4751 `cpe:2.3:o:microsoft:windows_11_23h2::::::::`
microsoft	windows_11_24h2	< 10.0.26100.2894 `cpe:2.3:o:microsoft:windows_11_24h2::::::::`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	< 10.0.14393.7699 `cpe:2.3:o:microsoft:windows_server_2016::::::::`
microsoft	windows_server_2019	< 10.0.17763.6775 `cpe:2.3:o:microsoft:windows_server_2019::::::::`
microsoft	windows_server_2022	< 10.0.20348.3091 `cpe:2.3:o:microsoft:windows_server_2022::::::::`
microsoft	windows_server_2022_23h2	< 10.0.25398.1369 `cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::`
microsoft	windows_server_2025	< 10.0.26100.2894 `cpe:2.3:o:microsoft:windows_server_2025:::::::x64:*`

Original advisory text

Windows Digital Media Elevation of Privilege Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21228 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

6.6 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published14 Jan 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-21228 · NVD

Track software like this

Free during beta