🛡️ CVE-2025-26633 — windows-10-1507

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack vector: Local — a local account, shell or session on the host is needed.
• Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
• Privileges required: None — an unauthenticated stranger can try it.
• User interaction: Required — someone has to click, open or visit something.
• Scope: Unchanged — the damage stays inside the vulnerable component.
• Confidentiality impact: High — total loss, or loss the attacker controls.
• Integrity impact: High — total loss, or loss the attacker controls.
• Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2025-26633 is classified as CWE-707: Improper Neutralization. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Affected software

CVE-2025-26633 is recorded against 15 packages.

• windows-10-1507 (fixed in 10.0.10240.20947)
• windows-10-1607 (fixed in 10.0.14393.7876)
• windows-10-1809 (fixed in 10.0.17763.7009)
• windows-10-21h2 (fixed in 10.0.19044.5608)
• windows-10-22h2 (fixed in 10.0.19045.5608)
• windows-11-22h2 (fixed in 10.0.22621.5039)
• windows-11-23h2 (fixed in 10.0.22631.5039)
• windows-11-24h2 (fixed in 10.0.26100.3403)
• windows-server-2008
• windows-server-2012
• windows-server-2016 (fixed in 10.0.14393.7876)
• windows-server-2019 (fixed in 10.0.17763.7009)
• windows-server-2022 (fixed in 10.0.20348.3270)
• windows-server-2022-23h2 (fixed in 10.0.25398.1486)
• windows-server-2025 (fixed in 10.0.26100.3403)

Timeline and source

Published on 11 March 2025 and last revised on 5 August 2026. A public exploit is known to exist, which raises the urgency of patching considerably. Record sourced from NVD.

References

msrc.microsoft.com
www.vicarius.io
www.vicarius.io
www.cisa.gov

Other advisories for this package

windows-10-1507 has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CVE-2025-64680 (7.8 High, published 9 Dec 2025)
• CVE-2025-64679 (7.8 High, published 9 Dec 2025)
• CVE-2025-62209 (5.5 Medium, published 11 Nov 2025)
• CVE-2025-62208 (5.5 Medium, published 11 Nov 2025)
• CVE-2025-58715 (8.8 High, published 14 Oct 2025)
• CVE-2025-59244 (6.5 Medium, published 14 Oct 2025)
• CVE-2025-55325 (5.5 Medium, published 14 Oct 2025)
• CVE-2025-59196 (7.0 High, published 14 Oct 2025)

Same weakness in other software

These advisories are the same class of weakness (CWE-707: Improper Neutralization) in other software:

• CVE-2026-4249 (8.6 High, published 6 Jul 2026)
• CVE-2025-66545 (3.5 Low, published 5 Dec 2025)
• CVE-2025-27712 (5.7 Medium, published 11 Nov 2025)
• CVE-2025-24921 (6.6 Medium, published 12 Aug 2025)
• GHSA-4gmq-m9vp-jrwg (2.0 Low, published 4 Nov 2024)
• CVE-2024-43572 (7.8 High, published 8 Oct 2024)
• CVE-2022-3801 (8.0 High, published 5 Jun 2024)
• CVE-2023-46689 (8.8 High, published 16 May 2024)

Details

Affected Packages

References