VDB
CVE-2025-54913
CVE-2025-54913
PUBLISHED
CVSS 7.8 HIGH
Windows UI XAML Maps MapControlSettings Elevation of Privilege Vulnerability
Reported by microsoft · Published September 9, 2025
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Windows Server 2019 | Microsoft | 10.0.17763.7792 |
| windows_server_2022 | microsoft | 10.0.20348.4106 |
| Windows Server 2019 (Server Core installation) | Microsoft | 10.0.17763.7792 |
Risk scores
CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 Version 1507 | 10.0.10240.0 |
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 |
| Microsoft | Windows 10 Version 21H2 | 10.0.19044.0 |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 |
| Microsoft | Windows 11 version 22H2 | 10.0.22621.0 |
| Microsoft | Windows 11 version 22H3 | 10.0.22631.0 |
| Microsoft | Windows 11 Version 23H2 | 10.0.22631.0 |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 |
| Microsoft | Windows Server 2016 | 10.0.14393.0 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 |
| microsoft | windows_11_23H2 | 10.0.22631.0 |
…and 27 more
Timeline
- Sep 9, 2025 CVE Published
- Sep 9, 2025 Coalition ESS Score (7 in total, the first dated here)
- Sep 10, 2025 EPSS Score (30 in total, the first dated here)
- Mar 11, 2026 Security Advisory (63 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-54913
vulnetix vdb fixes CVE-2025-54913Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-54913/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Windows UI XAML Maps MapControlSettings Elevation of Privilege Vulnerability vendor-advisorypatch