Skip to content
OpenAdvisories
Critical MSRC-CVE-2025-29833 1 CVE

Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability

Published May 13, 2025 · Updated May 14, 2025 · Revision 2

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?
An authorized attacker with privileges could send controlled inputs to exploit this vulnerability.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
Successful exploitation of this vulnerability could allow a Hyper-V guest to affect the functionality of the Hyper-V host.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

Security updates
10.0.17763.7314 — https://support.microsoft.com/help/5058392
10.0.20348.3692 — https://support.microsoft.com/help/5058385
10.0.20348.3630 — https://support.microsoft.com/help/5058500
10.0.19044.5854 — https://support.microsoft.com/help/5058379
10.0.22621.5335 — https://support.microsoft.com/help/5058405
10.0.26100.4061 — https://support.microsoft.com/help/5058411
10.0.26100.3981 — https://support.microsoft.com/help/5058497
10.0.25398.1611 — https://support.microsoft.com/help/5058384
10.0.10240.21014 — https://support.microsoft.com/help/5058387
10.0.14393.8066 — https://support.microsoft.com/help/5058383
6.2.9200.25475 — https://support.microsoft.com/help/5058451
6.3.9600.22577 — https://support.microsoft.com/help/5058403

Vulnerabilities 1

Revision history

  1. #2

    Added an FAQ and updated the CVSS score. This is an informational change only.

  2. #1

    Information published.

References