BaseFortify

Publication date: 2025-11-11

Last updated on: 2025-11-17

Assigner: Microsoft Corporation

Description

Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-11

Last Modified

2025-11-17

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-60708

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_10_1607	to 10.0.14393.8594 (exc)
microsoft	windows_10_1809	to 10.0.17763.8027 (exc)
microsoft	windows_10_21h2	to 10.0.19044.6575 (exc)
microsoft	windows_10_22h2	to 10.0.19045.6575 (exc)
microsoft	windows_11_23h2	to 10.0.22631.6199 (exc)
microsoft	windows_11_24h2	to 10.0.26100.7092 (exc)
microsoft	windows_11_25h2	to 10.0.26200.7092 (exc)
microsoft	windows_server_2016	to 10.0.14393.8594 (exc)
microsoft	windows_server_2019	to 10.0.17763.8027 (exc)
microsoft	windows_server_2022	to 10.0.20348.4346 (exc)
microsoft	windows_server_2022_23h2	to 10.0.25398.1965 (exc)
microsoft	windows_server_2025	to 10.0.26100.7092 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-822	The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is an untrusted pointer dereference in the Storvsp.sys driver. It allows an authorized local attacker to cause a denial of service by exploiting how the driver handles pointers.

Impact Analysis

An authorized local attacker can exploit this vulnerability to cause a denial of service, potentially making the affected system or service unavailable.

Hi! I’m here to help you understand CVE-2025-60708. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70