CVE-2025-25199
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-25199
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-25199.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-25199
- Aliases
- Downstream
- Related
- Published
- 2025-02-12T17:49:58Z
- Modified
- 2025-10-20T19:32:48Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- BCryptGenerateSymmetricKey memory leak
- Details
-
go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to
cng.TLS1PRFdon't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41 contains a fix for the issue. The fix is included in versions 1.23.6-2 and 1.22.12-2 of the Microsoft build of go, as well as in the pseudoversion 0.0.0-20250211154640-f49c8e1379ea of thegithub.com/microsoft/go-crypto-winnativeGo package. - Database specific
{ "cwe_ids": [ "CWE-401" ] }- References