BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-23

Assigner: Microsoft Corporation

Description

Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-23

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-53139

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_10_21h2	to 10.0.19044.6456 (exc)
microsoft	windows_10_22h2	to 10.0.19045.6456 (exc)
microsoft	windows_11_22h2	to 10.0.22621.6060 (exc)
microsoft	windows_11_23h2	to 10.0.22631.6060 (inc)
microsoft	windows_11_24h2	to 10.0.26100.6899 (exc)
microsoft	windows_11_25h2	to 10.0.26200.6899 (exc)
microsoft	windows_server_2025	to 10.0.26100.6899 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves the cleartext transmission of sensitive information in Windows Hello, which allows an unauthorized attacker to locally bypass a security feature.

Impact Analysis

An attacker could exploit this vulnerability to bypass security features on a local system, potentially gaining unauthorized access to sensitive information or functionality.

Hi! I’m here to help you understand CVE-2025-53139. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70