CVE-2025-29974: Windows 10 1507 Information Disclosure

CVE-2025-29974 Overview

CVE-2025-29974 is an integer underflow vulnerability in the Windows Kernel that permits information disclosure across an adjacent network. Microsoft published the advisory on May 13, 2025, covering desktop and server editions spanning Windows 10, Windows 11, and Windows Server 2008 through Windows Server 2025. Exploitation requires user interaction and adjacency to the target network segment, but does not require prior authentication. The flaw is tracked under CWE-125 (Out-of-bounds Read) and CWE-191 (Integer Underflow).

Critical Impact
Successful exploitation lets an unauthenticated adjacent attacker read kernel memory contents, exposing sensitive data that can support follow-on privilege escalation or lateral movement.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
All supported x86, x64, and ARM64 architectures

Discovery Timeline

2025-05-13 - Microsoft releases security patch and publishes advisory
2025-05-13 - CVE-2025-29974 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29974

Vulnerability Analysis

CVE-2025-29974 is an integer underflow in the Windows Kernel that produces an out-of-bounds read. When the kernel processes a specific network-derived input, an arithmetic operation wraps below zero, generating an extremely large unsigned length value. That value drives a subsequent read past the intended buffer boundary, returning kernel memory contents to the attacker.

The issue affects the entire supported Windows lineup, from legacy Windows Server 2008 SP2 through Windows Server 2025 and Windows 11 24H2. Because the root cause resides in shared kernel code, the same defect surfaces consistently across desktop and server SKUs.

Information disclosure at the kernel layer is a common precursor to full compromise. Leaked pointers, tokens, or session material can be used to bypass Address Space Layout Randomization (ASLR) or to prepare a subsequent memory corruption exploit.

Root Cause

The defect is an integer underflow [CWE-191] paired with an out-of-bounds read [CWE-125]. Untrusted numeric input is used in a subtraction operation without sufficient validation, producing a wrapped value that is later treated as a positive length. The resulting read exceeds the source buffer and exposes adjacent kernel memory.

Attack Vector

The attack vector is Adjacent Network, meaning the attacker must reside on the same logical or physical network segment as the target. User interaction is required, indicating a victim action is needed to trigger the vulnerable code path. No authentication is required. Impact is limited to confidentiality; integrity and availability are unaffected.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Microsoft has not observed exploitation in the wild at time of publication. See the Microsoft Security Advisory CVE-2025-29974 for vendor-specific technical details.

Detection Methods for CVE-2025-29974

Indicators of Compromise

Unexpected inbound traffic from adjacent hosts targeting kernel-level network protocols on unpatched systems.
Endpoint telemetry showing kernel exceptions, bug checks, or crashes correlated with recent adjacent-network sessions.
User-interaction events (opening files, previewing content, connecting to shares) immediately preceding anomalous kernel activity.

Detection Strategies

Deploy endpoint detection and response (EDR) tooling capable of monitoring kernel-mode anomalies and out-of-bounds memory access patterns.
Correlate authentication and session logs with kernel crash dumps to identify adjacent-network triggers.
Maintain vulnerability scanning that flags hosts missing the May 2025 Microsoft cumulative updates for CVE-2025-29974.

Monitoring Recommendations

Centralize Windows kernel event logs (Event IDs related to WHEA-Logger and Kernel-General) in a SIEM for correlation.
Monitor East-West network traffic on Layer 2 segments where trusted and untrusted endpoints coexist.
Alert on repeated protocol negotiation failures or malformed packets originating from a single adjacent host.

How to Mitigate CVE-2025-29974

Immediate Actions Required

Apply the May 2025 Microsoft security updates addressing CVE-2025-29974 to all Windows client and server systems.
Prioritize patching for hosts on shared network segments, guest Wi-Fi adjacent zones, and multi-tenant infrastructure.
Inventory legacy systems (Windows Server 2008/2012) and confirm they receive Extended Security Updates where applicable.

Patch Information

Microsoft released fixes on May 13, 2025 as part of the monthly security update cycle. Refer to the Microsoft Security Advisory CVE-2025-29974 for the specific KB article corresponding to each supported Windows build. Install the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or your enterprise patch management platform.

Workarounds

Segment untrusted devices onto isolated VLANs to remove adjacent-network reachability to sensitive Windows hosts.
Enforce 802.1X authentication and wireless client isolation on Wi-Fi networks serving corporate endpoints.
Restrict user actions that trigger network-parsing code paths on unpatched systems until updates are deployed.

bash

# Verify installation of the May 2025 cumulative update on Windows
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2025-05-13') } | Sort-Object InstalledOn -Descending

# Force Windows Update scan and install
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall