PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-30400 Microsoft CVE debrief

CVE-2025-30400 is a Microsoft Windows vulnerability in the DWM Core Library that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 2025-05-13. Because it is KEV-listed, defenders should treat it as a high-priority remediation item and work toward closure by the CISA due date of 2025-06-03, using Microsoft’s guidance and applicable CISA instructions.

Vendor
Microsoft
Product
Windows
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-05-13
Original CVE updated
2025-05-13
Advisory published
2025-05-13
Advisory updated
2025-05-13

Who should care

Organizations running Microsoft Windows, especially endpoint, desktop, and patch-management teams responsible for tracking and closing CISA KEV items.

Technical summary

The supplied corpus identifies CVE-2025-30400 as a use-after-free vulnerability in the Microsoft Windows DWM Core Library. No additional technical details are provided in the supplied sources about exploit preconditions, affected versions, privileges, or impact. The strongest evidence in the corpus is CISA’s KEV listing, which indicates known exploitation activity and makes timely remediation necessary.

Defensive priority

High. CISA has placed this CVE in the KEV catalog, so it should be prioritized ahead of routine updates and tracked to completion by the listed due date.

Recommended defensive actions

  • Review Microsoft’s security guidance for CVE-2025-30400 and apply the recommended updates or mitigations as soon as possible.
  • Prioritize affected Windows systems in your patching workflow and confirm remediation before the CISA due date of 2025-06-03.
  • If mitigations are unavailable for any environment, follow CISA BOD 22-01 guidance where applicable and document any exceptions.
  • Validate closure through endpoint inventory and vulnerability management reporting, not just patch deployment.
  • Monitor Microsoft and CISA advisories for any updates related to CVE-2025-30400.

Evidence notes

The evidence corpus includes CISA KEV metadata marking this CVE as known exploited, with dateAdded 2025-05-13 and dueDate 2025-06-03. The official notes point to Microsoft’s MSRC update guide and the NVD record, but the supplied corpus does not include further technical analysis.

Official resources

Publicly disclosed in the supplied corpus through the CISA KEV catalog entry dated 2025-05-13; no additional disclosure timing details are provided beyond the CVE and source dates.