CVSS 3.1
7.0 highCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2025-59282
High (7.0) in microsoft. EPSS 0.6% chance of exploitation in the next 30 days.
Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-362, CWE-416
- Published
- Modified
- Record from
- the NVD, synced
Affected
- microsoft:windows_10_1507
- microsoft:windows_10_1607
- microsoft:windows_10_1809
- microsoft:windows_10_21h2
- microsoft:windows_10_22h2
- microsoft:windows_11_22h2
- microsoft:windows_11_23h2
- microsoft:windows_11_24h2
- microsoft:windows_11_25h2
- microsoft:windows_server_2008
- microsoft:windows_server_2012
- microsoft:windows_server_2016
- microsoft:windows_server_2019
- microsoft:windows_server_2022
- microsoft:windows_server_2022_23h2
- microsoft:windows_server_2025
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59282
- https://www.vicarius.io/vsociety/posts/cve-2025-59282-detection-script-race-condition-in-microsoft-inbox-com-objects
- https://www.vicarius.io/vsociety/posts/cve-2025-59282-mitigation-script-race-condition-in-microsoft-inbox-com-objects