Microsoft Windows up to Server 2025 Scripting Engine type confusion

Summaryinfo

A vulnerability identified as problematic has been detected in Microsoft Windows. Impacted is an unknown function of the component Scripting Engine. Performing a manipulation results in type confusion. This vulnerability is cataloged as CVE-2025-30397. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as problematic has been found in Microsoft Windows. This affects some unknown functionality of the component Scripting Engine. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

The weakness was shared 05/13/2025 as confirmed security update guide (Website). The advisory is shared at msrc.microsoft.com. This vulnerability is uniquely identified as CVE-2025-30397. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available.

The exploit is shared for download at exploit-db.com. It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 05/13/2025 with a due date of 06/03/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (52315), Zero-Day.cz (1001), EUVD (EUVD-2025-14411) and CERT Bund (WID-SEC-2025-1050). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Hitachi Storage
• Microsoft Windows Server 2019
• Microsoft Windows Server
• Microsoft Windows
• Microsoft Windows 11
• Microsoft Windows Server 2022
• Microsoft Windows 10
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10
• 10 21H2
• 10 22H2
• 10 1607
• 10 1809
• 11 22H2
• 11 23H2
• 11 24H2
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2012 R2
• Server 2016
• Server 2019
• Server 2022
• Server 2022 23H2
• Server 2025

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion