CVE-2025-32720

EUVD-2025-17786
Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
microsoftCNA
5.5 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
microsoftwindows_10_1507
𝑥
< 10.0.10240.21034
microsoftwindows_10_1507
𝑥
< 10.0.10240.21034
microsoftwindows_10_1607
𝑥
< 10.0.14393.8148
microsoftwindows_10_1607
𝑥
< 10.0.14393.8148
microsoftwindows_10_1809
𝑥
< 10.0.17763.7434
microsoftwindows_10_1809
𝑥
< 10.0.17763.7434
microsoftwindows_10_21h2
𝑥
< 10.0.19044.5965
microsoftwindows_10_22h2
𝑥
< 10.0.19045.5965
microsoftwindows_11_22h2
𝑥
< 10.0.22621.5472
microsoftwindows_11_23h2
𝑥
< 10.0.22631.5472
microsoftwindows_11_24h2
𝑥
< 10.0.26100.4270
microsoftwindows_server_2016
𝑥
< 10.0.14393.8148
microsoftwindows_server_2019
𝑥
< 10.0.17763.7434
microsoftwindows_server_2022
𝑥
< 10.0.20348.3745
microsoftwindows_server_2022_23h2
𝑥
< 10.0.25398.1665
microsoftwindows_server_2025
𝑥
< 10.0.26100.4270
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
(x64, x86)
1607 (x64, x86)
1809 (x64, x86)
21H2 (arm64, x64, x86)
22H2 (arm64, x64, x86)
Windows 11
22H2 (arm64, x64)
23H2 (arm64, x64)
24H2 (arm64, x64)
Windows Server 2012 R2
Server Core
Standard
Windows Server 2016
Server Core
Standard
Windows Server 2019
Server Core
Standard
Windows Server 2022
23H2 Server Core
Server Core
Standard
Windows Server 2025
Server Core
Standard