CVE-2025-32720 is a medium-severity vulnerability identified as an out-of-bounds read (CWE-125) in the Windows Storage Management Provider component of Microsoft Windows 10 Version 1809 (build 10.0.17763.0). This vulnerability allows an authorized local attacker to read memory outside the intended buffer boundaries, potentially disclosing sensitive information from the system's memory. The flaw arises due to improper bounds checking in the storage management code, which can be exploited without requiring user interaction but does require the attacker to have some level of privileges (low privileges) on the affected system. The vulnerability does not impact system integrity or availability but compromises confidentiality by leaking potentially sensitive data. The CVSS v3.1 base score is 5.5, reflecting a medium severity with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. There are no known exploits in the wild at the time of publication, and no patches have been linked yet. The vulnerability was reserved in April 2025 and published in June 2025, indicating recent discovery and disclosure. This vulnerability affects only Windows 10 Version 1809, which is an older version of Windows 10, and may still be in use in some enterprise environments that have not upgraded to newer versions.

For European organizations, the primary impact of CVE-2025-32720 is the potential unauthorized disclosure of sensitive information on systems running Windows 10 Version 1809. This could include confidential business data, credentials, or other sensitive memory contents that an attacker with local access could extract. Since the vulnerability requires local privileges, the risk is higher in environments where multiple users share systems or where attackers can gain limited access through other means (e.g., phishing, lateral movement). The confidentiality breach could lead to further attacks, including privilege escalation or data exfiltration. Critical infrastructure, government agencies, and enterprises handling sensitive personal or financial data could be particularly impacted if they have legacy systems running this Windows version. The lack of integrity or availability impact means system operations are not directly disrupted, but the confidentiality breach could undermine trust and compliance with data protection regulations such as GDPR. Organizations relying on Windows 10 Version 1809 should assess their exposure, especially if systems are accessible by multiple users or if attackers could gain local access through other vulnerabilities or social engineering.

1. Upgrade and Patch: The most effective mitigation is to upgrade affected systems from Windows 10 Version 1809 to a supported and updated Windows version where this vulnerability is patched. Since no patch links are currently available, organizations should monitor Microsoft security advisories for updates and apply them promptly once released. 2. Limit Local Access: Restrict local access to systems running Windows 10 Version 1809 by enforcing strict access controls, using endpoint protection, and limiting user privileges to the minimum necessary. 3. Network Segmentation: Segment networks to reduce the risk of lateral movement that could lead to local access on vulnerable systems. 4. Monitor and Audit: Implement monitoring for unusual local access patterns or attempts to exploit storage management components. Use endpoint detection and response (EDR) tools to detect suspicious activity. 5. Application Whitelisting and Hardening: Use application control policies to prevent unauthorized code execution that could leverage this vulnerability. 6. User Awareness: Train users to recognize phishing and social engineering attempts that could lead to initial access. 7. Incident Response Preparedness: Prepare to respond to potential data disclosure incidents by having clear procedures and forensic capabilities.