[JoseMar]

[CVE-2025-32710] Windows RDP Vulnerability
Allows Remote Code Execution

Okay. So here’s one of those bugs that makes you pause mid-scroll and mutter something like... really? again?

CVE-2025-32710 just dropped, and while it hasn’t made headlines (yet), it’s exactly the kind of issue that quietly shows up in red team toolkits six months from now.

It’s a remote code execution vuln in Windows Remote Desktop Services, and it doesn’t require credentials. Which should already be setting off a few alarms.

Here's what’s going on:
The bug lives inside Remote Desktop Gateway, the part that lets people securely RDP into your internal network from outside. (Well... "securely" is doing a lot of heavy lifting here.)

The flaw is a combo of a use-after-free and a race condition. That’s two separate memory issues, working together in a way that lets attackers execute code remotely, without authentication.

No creds. No phishing. Just hitting the RDP Gateway over the network and exploiting memory the OS thinks it’s already done with.

Sounds familiar? It should. We've seen flavors of this before, but this one hits a wider range of Windows Server versions than usual.

Affected Versions:
Basically, if you’re running anything from 2008 to 2025, you’re in the blast radius.

• 2008 (SP2, 32-bit + x64)
  


• 2008 R2
  


• 2012 / 2012 R2
  


• 2016
  


• 2019
  


• 2022
  


• 2025
  

Yes, even Server 2025. Because no, being "up to date" doesn’t mean safe.

Technical (if you're into that):

• CWE-416: Use After Free
  


• CWE-362: Race Condition with Shared Resource
  


• CVSS score: 8.1
  


• Attack Vector: Network
  


• Privileges required: None
  


• User interaction: None
  

Microsoft says exploitation is “less likely.” Which feels... optimistic? Sure, the race condition adds complexity. But it’s not impossible. Just annoying, until someone automates it.

We’ve seen that before too.

What could go wrong?
Well. Everything.

Successful exploitation gives attackers system-level privileges. That’s full access. Not just watching RDP sessions — we’re talking about stealing data, planting backdoors, flipping configs, or knocking services offline completely.

Basically, if someone gets in this way, they’re not just visiting. They’re moving in.

Patches are live.
Microsoft pushed out fixes on June 10. Look for updates like:

• Server 2025 → KB5058411 / KB5058497
  


• Server 2022 → KB5058385 / KB5058500
  


• Server 2008 → KB5061198 / KB5058429
  

If you’re on any of the affected builds, check Windows Update or WSUS. Or, if you're the hands-on type, go straight to the Microsoft Update Catalog and grab them manually.

And if you’re running RDP Gateway exposed to the internet and not patched yet… I mean… maybe don’t sleep on this.

One last thing
Props to SmallerDragon from Kunlun Lab for finding this. The kind of vuln that makes you wonder what else is lurking in enterprise code that nobody’s looked at too closely in a decade.

No public PoC as of now. No active exploitation (that we know of). But we all know how that goes. The clock starts ticking the moment a patch drops.

If you're running a lab or simulating attacks for training, this one might be worth reproducing once someone reverse-engineers the patch. Just saying.

Let me know if you want a heads-up when a proof-of-concept drops.

Stay patched. Stay paranoid.

Additional sources to explore:
You can also search directly on Google for more information:

• https://medium.com/@infoziant/%EF%B8%8F-...75587f1245
  


• https://cybersecuritynews.com/windows-re...erability/
  


• https://msrc.microsoft.com/update-guide/...2025-32710
  

[Bastille]

Damn, "again" ...

RDS shouldn't be accessible without at least a VPN, or whitelisted IPs to reduce the risk. Putting RDP on the WAN is criminal

Glad that there is already a patch for this and no exploit available

Interested if there is a PoC, of course !

Thanks for this share Jose

[DramaKing]

Damn, "again" ...

RDS shouldn't be accessible without at least a VPN, or whitelisted IPs to reduce the risk. Putting RDP on the WAN is criminal

Glad that there is already a patch for this and no exploit available

Interested if there is a PoC, of course !

Thanks for this share Jose

Tell that to all of the cloud and virtual desktop users, including VPS.