CVE-2025-29808

Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

Scoring

Severity

MEDIUM

CVSS base score

5.5

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS probability

0.50%

CWE

CWE-1240

Published

2025-04-08

Last modified

2026-08-10

Affected products

• Microsoft Windows Server 2022

Weakness type

• CWE-1240

Related vulnerabilities

• CVE-2024-0323 — FTP uses unsecure encryption mechanisms
• CVE-2025-24802 — Soundness issue with Plonky2 look up tables
• CVE-2025-62514 — `libparsec_crypto` does not check for weak order point of curve 25519
• CVE-2024-0220 — B&R products use insufficient communication encryption
• CVE-2026-46654 — Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
• CVE-2025-46424 — Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerabilit
• CVE-2026-22705 — RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
• CVE-2023-51392 — Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM

Markdown version · Browse all CVEs