{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "\u003ca href=\"https://x.com/0patch\"\u003eBlaz Satler\u003c/a\u003e with \u003ca href=\"https://0patch.com/\"\u003e0patch by ACROS Security\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-27472 Windows Mark of the Web Security Feature Bypass Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27472"
      },
      {
        "category": "self",
        "summary": "CVE-2025-27472 Windows Mark of the Web Security Feature Bypass Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-27472.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Windows Mark of the Web Security Feature Bypass Vulnerability",
    "tracking": {
      "current_release_date": "2025-04-09T07:00:00.000Z",
      "generator": {
        "date": "2025-07-22T19:57:31.389Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-27472",
      "initial_release_date": "2025-04-08T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-04-08T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-04-09T07:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "The security updates for Windows 10 for 32-bit Systems and Windows 10 for x64-based Systems are now available. See the Security Updates table for more information."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.10240.20978",
            "product": {
              "name": "Windows 10 for 32-bit Systems \u003c10.0.10240.20978",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.10240.20978",
            "product": {
              "name": "Windows 10 for 32-bit Systems 10.0.10240.20978",
              "product_id": "10729"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 for 32-bit Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c10.0.10240.20978",
            "product": {
              "name": "Windows 10 for x64-based Systems \u003c10.0.10240.20978",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "10.0.10240.20978",
            "product": {
              "name": "Windows 10 for x64-based Systems 10.0.10240.20978",
              "product_id": "10735"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows 10 for x64-based Systems"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c6.2.9200.25423",
            "product": {
              "name": "Windows Server 2012 \u003c6.2.9200.25423",
              "product_id": "6"
            }
          },
          {
            "category": "product_version",
            "name": "6.2.9200.25423",
            "product": {
              "name": "Windows Server 2012 6.2.9200.25423",
              "product_id": "10378"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2012"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c6.2.9200.25423",
            "product": {
              "name": "Windows Server 2012 (Server Core installation) \u003c6.2.9200.25423",
              "product_id": "5"
            }
          },
          {
            "category": "product_version",
            "name": "6.2.9200.25423",
            "product": {
              "name": "Windows Server 2012 (Server Core installation) 6.2.9200.25423",
              "product_id": "10379"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2012 (Server Core installation)"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c6.3.9600.22523",
            "product": {
              "name": "Windows Server 2012 R2 \u003c6.3.9600.22523",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "6.3.9600.22523",
            "product": {
              "name": "Windows Server 2012 R2 6.3.9600.22523",
              "product_id": "10483"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2012 R2"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c6.3.9600.22523",
            "product": {
              "name": "Windows Server 2012 R2 (Server Core installation) \u003c6.3.9600.22523",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "6.3.9600.22523",
            "product": {
              "name": "Windows Server 2012 R2 (Server Core installation) 6.3.9600.22523",
              "product_id": "10543"
            }
          }
        ],
        "category": "product_name",
        "name": "Windows Server 2012 R2 (Server Core installation)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-27472",
      "cwe": {
        "id": "CWE-693",
        "name": "Protection Mechanism Failure"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt.",
          "title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L) and some loss of availability (A:L). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "To exploit this vulnerability, an attacker could host a file on an attacker-controlled server, then convince a targeted user to download and open the file. This could allow the attacker to interfere with the Mark of the Web functionality.\nPlease see Additional information about Mark of the Web for further clarification",
          "title": "How could an attacker exploit the vulnerability?"
        },
        {
          "category": "faq",
          "text": "Yes. As of April 9, 2025, the security update (5055547) for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems  are available. Customers running Windows 10 should ensure the update is installed to be protected from this vulnerability.",
          "title": "Are the updates for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems currently available?"
        }
      ],
      "product_status": {
        "fixed": [
          "10378",
          "10379",
          "10483",
          "10543",
          "10729",
          "10735"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-27472 Windows Mark of the Web Security Feature Bypass Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27472"
        },
        {
          "category": "self",
          "summary": "CVE-2025-27472 Windows Mark of the Web Security Feature Bypass Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-27472.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "10.0.10240.20978:Security Update:https://support.microsoft.com/help/5055547",
          "product_ids": [
            "2",
            "1"
          ],
          "url": "https://support.microsoft.com/help/5055547"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "6.2.9200.25423:Monthly Rollup:https://support.microsoft.com/help/5055581",
          "product_ids": [
            "6",
            "5"
          ],
          "url": "https://support.microsoft.com/help/5055581"
        },
        {
          "category": "vendor_fix",
          "date": "2025-04-08T07:00:00.000Z",
          "details": "6.3.9600.22523:Monthly Rollup:https://support.microsoft.com/help/5055557",
          "product_ids": [
            "4",
            "3"
          ],
          "url": "https://support.microsoft.com/help/5055557"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.7,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Security Feature Bypass"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely"
        }
      ],
      "title": "Windows Mark of the Web Security Feature Bypass Vulnerability"
    }
  ]
}