CVE-2025-30397

What it actually does

CVE-2025-30397 is a type-confusion memory-corruption flaw in the Microsoft Scripting Engine. When the engine processes specially crafted script content, it can treat an object as the wrong internal type, corrupt memory, and allow attacker-controlled code execution. Exploitation is network-reachable through content that invokes the vulnerable scripting engine, such as malicious web content, HTML/script files, or documents that cause Windows scripting components to parse attacker-supplied script. Successful code execution typically runs in the context of the user or hosting application that opened the content, enabling payload execution, credential theft, lateral-movement tooling, or malware installation.

Why it matters to the business

This vulnerability can let an external attacker compromise Windows endpoints through malicious content without needing valid credentials. Because it is listed in CISA KEV, has active exploitation in the wild, and had a remediation deadline of 2025-06-03, unpatched systems should be treated as high priority even though the CVSS score is 7.5. Operational consequences include endpoint compromise, data theft, malware deployment, browser- or document-based intrusion chains, and potential follow-on ransomware or espionage activity if the initial foothold is not contained.

How an attack unfolds

An attacker prepares content that exercises the vulnerable Microsoft Scripting Engine code path and triggers type confusion during script execution. The content may be hosted on a malicious or compromised website, delivered as an attachment or link, embedded in an HTML application, or included in document-based phishing. When a user or vulnerable host application opens the content, the scripting engine mismanages object types in memory. The attacker uses that corruption to redirect execution flow and run shellcode or a staged payload. The payload commonly launches a child process, downloads additional tooling, establishes command-and-control, steals credentials or browser data, and attempts persistence or lateral movement. Because the vulnerability is known to be exploited in the wild, detection should assume real-world attacks may use obfuscation, fileless script execution, living-off-the-land Windows binaries, and short-lived payload staging infrastructure.

How to fix it

Apply the Microsoft security update that fixes CVE-2025-30397, including the May 2025 or later cumulative updates for all supported Windows versions and any affected Microsoft components that host the scripting engine. Prioritize internet-facing user workstations, VDI images, jump boxes, and systems where users open email attachments or web content. If immediate patching is not possible, reduce exposure by restricting legacy script execution where feasible, disabling or limiting Windows Script Host for users who do not require it, enforcing Office protected view and attachment blocking, blocking execution of HTA/script files from email and web download locations, using application control to limit mshta.exe, wscript.exe, cscript.exe, and rundll32.exe abuse, and ensuring endpoint protection has current signatures and behavior rules. Mitigations should be treated as temporary; the durable fix is to install the vendor update.

How to confirm the fix worked

Confirm that Windows cumulative security updates released in May 2025 or later are installed on all applicable systems. Validate using centralized patch compliance tooling, Windows Update history, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune reporting, or PowerShell checks such as Get-HotFix and OS build verification against Microsoft’s release notes. Reboot systems where required and re-scan to ensure the vulnerable scripting engine binaries have been replaced. Where compensating controls were applied, test that untrusted .js, .jse, .vbs, .vbe, .wsf, .hta, and downloaded script content cannot execute outside approved workflows. Confirm EDR telemetry is available for script host process creation, child processes, network connections, and suspicious module loads involving Microsoft scripting components.

Typical attack path

1. Attacker crafts malicious script content that triggers the Microsoft Scripting Engine type-confusion condition.
2. Attacker delivers the content through a phishing email, malicious link, compromised website, HTML application, or document that invokes Windows scripting components.
3. Victim opens or previews the content, or a vulnerable application processes the attacker-controlled script.
4. The scripting engine corrupts memory and transfers execution to attacker-controlled code.
5. Attacker executes a payload in the context of the current user or hosting process.
6. Payload spawns scripting or living-off-the-land processes, downloads additional malware, or runs commands in memory.
7. Attacker establishes command-and-control, collects credentials or data, and attempts persistence or lateral movement.

How to detect it

To determine whether exploitation has already occurred, review endpoint, proxy, email, DNS, and EDR telemetry for activity where browsers, Office applications, or script hosts processed suspicious content and then spawned unexpected child processes. Focus on the period from the publication date, 2025-05-13, onward, and expand earlier if threat intelligence indicates pre-disclosure exploitation. Key telemetry sources include Windows Security logs, Sysmon process creation and network events, PowerShell logs, Microsoft Defender for Endpoint advanced hunting, EDR process trees, browser download history, email gateway attachment/link logs, web proxy logs, DNS logs, and file creation events in user download/temp/cache directories. Look for wscript.exe, cscript.exe, mshta.exe, iexplore.exe, Office processes, or browser processes spawning cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, or encoded/scripted commands. Also look for script-host processes making outbound network connections, unusual DLL loads involving jscript.dll or vbscript.dll, recently created .hta/.js/.jse/.vbs/.vbe/.wsf files, and persistence created shortly after suspicious script execution. Because no single public IOC uniquely identifies exploitation, prioritize behavioral correlation: suspicious content delivery followed by scripting-engine execution, memory-corruption crash artifacts, payload staging, credential access, persistence, and command-and-control.

• wscript.exe
• cscript.exe
• mshta.exe
• jscript.dll
• vbscript.dll
• iexplore.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin.exe /transfer
• .hta
• .js
• .jse
• .vbs
• .vbe
• .wsf
• Windows Script Host
• Microsoft JScript runtime error
• Application Error
• Faulting module name: jscript.dll
• Faulting module name: vbscript.dll
• Faulting application name: wscript.exe
• Faulting application name: cscript.exe
• Faulting application name: mshta.exe

What your security team should do

• Immediately identify and patch all supported Windows systems that have not received the May 2025 or later security update; KEV-listed active exploitation makes this an urgent remediation item.
• Prioritize endpoints used for email, browsing, document handling, administrative access, and remote access because these are common initial exploitation targets.
• Review EDR/SIEM telemetry since at least 2025-05-13 for suspicious script-host activity, unusual child processes, and post-exploitation behavior associated with wscript.exe, cscript.exe, mshta.exe, iexplore.exe, Office applications, and browser processes.
• Hunt for phishing, malicious links, HTML applications, script attachments, and documents that launched scripting engines or spawned command interpreters, PowerShell, rundll32, regsvr32, certutil, bitsadmin, or curl.
• Temporarily restrict Windows Script Host, HTA execution, and script file execution from user-writable and internet download locations where business operations allow.
• Ensure email and web gateways block or detonate .hta, .js, .jse, .vbs, .vbe, .wsf, and suspicious HTML/script attachments.
• Enable attack surface reduction, application control, and EDR rules that detect script-to-process execution chains and suspicious network connections from scripting hosts.
• For any system showing suspicious activity, isolate the endpoint, collect memory/process/network artifacts, rotate potentially exposed credentials, and investigate lateral movement.