{"id":"CVE-2025-59250","state":"PUBLISHED","title":"JDBC Driver for SQL Server Spoofing Vulnerability","description":"Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.","publishedAt":"2025-10-14T17:00:42.700Z","updatedAt":"2026-02-26T17:47:15.996Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Microsoft JDBC Driver for SQL Server 10.2","Microsoft Microsoft JDBC Driver for SQL Server 11.2","Microsoft Microsoft JDBC Driver for SQL Server 12.10","Microsoft Microsoft JDBC Driver for SQL Server 12.2","Microsoft Microsoft JDBC Driver for SQL Server 12.4","Microsoft Microsoft JDBC Driver for SQL Server 12.6","Microsoft Microsoft JDBC Driver for SQL Server 12.8","Microsoft Microsoft JDBC Driver for SQL Server 13.2"],"affected":[{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 10.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"10.2.4","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 11.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"11.2.4","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.10","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.10.2","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.2.1","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.4","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.4.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.6","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.6.5","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.8","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.8.2","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 13.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"13.2.1","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/59xxx/CVE-2025-59250.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-59250","state":"PUBLISHED","datePublished":"2025-10-14T17:00:42.700Z","dateUpdated":"2026-02-26T17:47:15.996Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2025-09-11T04:30:28.170Z"},"containers":{"cna":{"title":"JDBC Driver for SQL Server Spoofing Vulnerability","descriptions":[{"lang":"en-US","value":"Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network."}],"affected":[{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 10.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"10.2.4","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 11.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"11.2.4","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.10","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.10.2","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.2.1","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.4","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.4.3","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.6","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.6.5","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 12.8","versions":[{"version":"1.0.0","status":"affected","lessThan":"12.8.2","versionType":"custom"}]},{"vendor":"Microsoft","product":"Microsoft JDBC Driver for SQL Server 13.2","versions":[{"version":"1.0.0","status":"affected","lessThan":"13.2.1","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250","name":"JDBC Driver for SQL Server Spoofing Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-02-22T17:24:50.372Z"},"datePublic":"2025-10-14T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.4:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"12.4.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.2:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"12.2.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.8:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"12.8.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_10.2:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"10.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_11.2:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"11.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.6:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"12.6.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_13.2:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"13.2.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:jdbc_driver_for_sql_server_12.10:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"12.10.2"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-59250","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-10-17T03:55:30.416492Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T17:47:15.996Z"}}]}}}