SB2025011483 - Multiple vulnerabilities in Microsoft Windows COM Server

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use of uninitialized resource (CVE-ID: CVE-2025-21288)

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Windows COM Server. A local user can pass specially crafted data to the application, trigger uninitialized usage of resources and gain access to sensitive information on the target system.

2) Use of uninitialized resource (CVE-ID: CVE-2025-21272)

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Windows COM Server. A local user can pass specially crafted data to the application, trigger uninitialized usage of resources and gain access to sensitive information on the target system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21288
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21272