PT-2025-28529

CVE-2025-48000

Published

2025-07-08

Updated

2025-09-16

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows Connected Devices Platform Service (affected versions not specified)

Description: The issue is related to a use after free condition in the Windows Connected Devices Platform Service, which allows an authorized attacker to elevate privileges locally. This means an attacker with initial access to the system could potentially gain higher levels of access.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

He Yisheng

Zhang Wangjunjie

Vendors

Affected products

Weakness enumeration

CWE-416: Use After Free

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\'Race Condition\')

Related identifiers

CVE-2025-48000