CVE-2025-30397

What it is

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

In the wild

CISA lists this as exploited in real attacks. Treat as urgent.

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-03-21 19:09 UTC ReservedThe CVE id was reserved by its CNA
2. 2025-05-13 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
3. 2025-05-13 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
4. 2025-06-03 Remediation deadlineCISA's due date for federal agencies to fix it
5. 2026-06-17 09:08 UTC Last updatedMost recent change to the record

Details

Published

2025-05-13 17:16 UTC

Last modified

2026-06-17 09:08 UTC

Added to CISA KEV

2025-05-13

Exploit probability

27.3% · EPSS, next 30 days

Weakness

CWE-843

Record status

Analyzed

Affected

• Microsoft Windows 10 1507 < 10.0.10240.21014
• Microsoft Windows 10 1607 < 10.0.14393.8066
• Microsoft Windows 10 1809 < 10.0.17763.7314
• Microsoft Windows 10 21h2 < 10.0.19044.5854
• Microsoft Windows 10 22h2 < 10.0.19045.5854
• Microsoft Windows 11 22h2 < 10.0.22621.5335
• Microsoft Windows 11 23h2 < 10.0.22631.5335
• Microsoft Windows 11 24h2 < 10.0.26100.3981

Attack profile CVSS 3.1 · 7.5

Attack vector

Network

Complexity

High

Privileges needed

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High