CVE-2025-29808: medium-severity vulnerability in Microsoft Windows Server 2022
Windows Cryptographic Services Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A weakness in how Windows handles cryptographic operations allows an authorized user on a computer to access sensitive information that should be protected. This could expose encryption keys or other confidential data.
CWE-1240 involves use of a cryptographic primitive with inadequate implementation in Windows Cryptographic Services. An authenticated local attacker can exploit this to perform information disclosure; the vulnerability requires prior system access and valid credentials, with impact limited to confidentiality of cryptographic material or related secrets.
In the same product, most dangerous first.