CVE-2025-58720: high-severity vulnerability in Microsoft Windows 10 Version 1809
Windows Cryptographic Services Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Windows Cryptographic Services uses a risky cryptographic method that allows an authorized attacker to steal sensitive information from the system. This matters because cryptographic services protect important data like passwords and encryption keys.
A flawed cryptographic primitive implementation in Windows Cryptographic Services enables local information disclosure via CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation). An authorized local attacker can exploit this vulnerability to extract sensitive cryptographic material or related secrets; the attack requires prior system access but does not require elevated privileges.
In the same product, most dangerous first.