“An attacker could successfully exploit this vulnerability by connecting to a system with the Remote Desktop Gateway role, triggering the race condition to create a use-after-free scenario, and then leveraging this to execute arbitrary code,” Microsoft explained in their advisory. Identified as CVE-2025-27480, this use-after-free vulnerability in the Remote Desktop Gateway Service has received a CVSS score of 8.1, indicating its high severity and potential impact on enterprise environments worldwide. The vulnerability has been assigned a critical CVSS vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, indicating that while the attack complexity is high due to the need to win a race condition, no privileges or user interaction are required for exploitation. This heap-based buffer overflow vulnerability carries a CVSS score of 8.0 and could enable attackers controlling a malicious RDP server to execute code on a client machine when a user connects to it. “This vulnerability CVE-2025-27480 underscores the continued risk posed by remote access services,” said a cybersecurity analyst at Kunlun Lab, whose researcher was credited with discovering the vulnerability. The Remote Desktop Gateway service vulnerability occurs when the application incorrectly handles objects in memory, leading to a use-after-free condition. Unlike CVE-2025-27480, this second vulnerability requires user interaction (UI:R) and low privileges (PR:L), meaning exploitation would only occur if a user actively connects to a compromised server. The vulnerability CVE-2025-27480, classified as Use After Free, allows an unauthorized attacker to execute malicious code over a network by exploiting a memory management issue. The race condition aspect of the vulnerability requires precise timing by potential attackers, which slightly reduces the immediate risk but does not diminish the overall severity. Microsoft also disclosed CVE-2025-27487, an “Important” rated vulnerability affecting the Remote Desktop Client. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 09 Apr 2025 09:50:09 +0000