CVE-2025-30397

ENISA EUVD: EUVD-2025-14411 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 5, 2026 2 articles Published: 2025-05-13

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

20.74%

probability

This CVE has a 20.74% probability of being exploited in the next 30 days.

0% Top 95.7th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.5

HIGH

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Functional

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Description

NVD

Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.

Affected Products

Microsoft

Windows 10 Version 1507

10.0.10240.0

Microsoft

Windows 10 Version 1607

10.0.14393.0

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows 10 Version 21H2

10.0.19044.0

Microsoft

Windows 10 Version 22H2

10.0.19045.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.1611

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.7314

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.4061

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.22577

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.22577

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.7314

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.8066

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.5335

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23279

Microsoft

Windows 10 Version 21H2

10.0.19044.0 <10.0.19044.5854

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.8066

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.8066

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.25475

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.7314

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.5335

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.5854

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

6.0.6003.0 <6.0.6003.23279

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.4061

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.4061

Microsoft

Windows 10 Version 1507

10.0.10240.0 <10.0.10240.21014

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.3692

Microsoft

Windows Server 2008 R2 Service Pack 1

6.1.7601.0 <6.1.7601.27729

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23279

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.5335

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.25475

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

6.1.7601.0 <6.1.7601.27729

Attack Intelligence

CWE-664 · Improper Control of a Resource Through its Lifetime CWE-704 · Incorrect Type Conversion CWE-843 · Type Confusion

Google Project Zero

Patched

May 13, 2025

Reported by

Microsoft Threat Intelligence Center

Root Cause Analysis

???

Exploits & PoC

mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-

Remote Code Execution via Use-After-Free in JScript.dll (CVE-2025-30397)

67 2025-05-31

1 repo — triés par ⭐ Rechercher sur GitHub ↗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397

vendor-advisory patch

Signal Intelligence

Confidenceⓘ

95%

EPSS 20.74%

CVSS v3.1 7.5

Mentions 2

Last Seen May 13, 2025

CNA Information

CNA Assigner

microsoft

CNA Title

Scripting Engine Memory Corruption Vulnerability

Analyst Note

Auto-imported from Google Project Zero — confirmed zero-day by definition.

Threat Actors 3

Circles

apt_group Global

APT 5

apt_group Information theft and espionage 🇨🇳 CN

Storm-2460

apt_group 🇷🇺 RU

Triage Info

Decided atMar 05, 2026

Published DateMay 13, 2025