VHDX Vulnerability CVE-2025-47971: Buffer Over-read Enables Privilege Escalation

Introduction

A critical buffer over-read vulnerability (CVE-2025-47971) has been identified in Microsoft's Virtual Hard Disk (VHDX) component, posing a significant risk of local privilege escalation. This flaw allows attackers with local access to escalate their privileges to SYSTEM level, potentially compromising entire systems and networks. Microsoft has classified this vulnerability as important, assigning it a CVSS score of 7.8.

Technical Information

The vulnerability results from a buffer over-read (CWE-126) within the VHDX driver, specifically due to inadequate validation of memory offsets during read operations. When processing maliciously crafted VHDX files, the driver reads beyond the intended buffer boundary, exposing sensitive kernel memory. Attackers can exploit this exposure to escalate privileges locally.

The exploitation process involves:

Local access to the target system.
Mounting a specially crafted VHDX file.
Triggering the buffer over-read to access kernel memory.

This improper memory handling can lead to unauthorized privilege escalation, enabling attackers to gain SYSTEM-level access.

Patch Information

Microsoft's July 2025 Security Update (KB5060829) for Windows 11 addresses this vulnerability. Key enhancements include:

Default App Settings for EEA: Compliance with the Digital Markets Act (DMA), allowing broader default app assignments and simplified PDF handling.
Taskbar Enhancements: New options for smaller taskbar buttons and improved system tray accessibility.

To enable taskbar enhancements, users can utilize ViveTool:

vivetool /enable /id:29785184
vivetool /enable /id:56887328

These updates reflect Microsoft's commitment to enhancing user experience and ensuring compliance with regional regulations.

Affected Systems and Versions

Windows 11 versions: 22H2, 23H2, 24H1
Windows Server 2025: All editions
Windows Server 2022: Standard, Datacenter
Hyper-V Hosts: All versions using VHDX storage
Azure Virtual Machines: Generation 2 VMs with VHDX disks

Vendor Security History

Microsoft has previously encountered similar memory safety vulnerabilities within virtualization components. Their consistent monthly Patch Tuesday updates demonstrate a structured response, though recurrent issues highlight ongoing challenges in securing complex virtual storage systems.

References

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]