External risk intelligence

Azure Application Gateway Privilege Escalation via Stack Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-64657

Azure Application Gateway is a load balancer and web traffic manager designed specifically to be an internet-facing edge service. It sits at the network edge to process incoming traffic, making its surface area public-facing by design in standard deployment patterns.

Out-of-bounds Write

Microsoft Azure Application Gateway

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Azure Application Gateway, a widely used service for managing network traffic. This issue could allow an unauthorized attacker to gain elevated privileges remotely.

Remote attackers can gain system control.
Confirms exposure of internet-facing gateway services.
Verify relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic to an exposed Azure Application Gateway. This traffic would target a weakness in how the gateway handles data, causing a buffer overflow that could allow the attacker to execute arbitrary code and gain elevated privileges.

Network access required.
Vulnerable component processes crafted traffic.
Privilege escalation risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthorized attacker to elevate privileges over a network by exploiting a stack-based buffer overflow in Azure Application Gateway. When supported by the advisory, this could lead to unauthorized access and modification of resources.

System privileges and network access.
Network-based buffer overflow exploitation.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Azure Application Gateway, a publicly exposed service. Ownership typically falls to the cloud platform or infrastructure teams responsible for managing Azure services, potentially requiring coordination with network and security teams to assess and mitigate exposure. The first practical step is to identify all instances of Azure Application Gateway, confirm their internet-facing status and business criticality, and then engage the accountable platform owner to plan remediation.

Cloud platform and infrastructure teams own the issue.
Verify internet-facing Application Gateway instances.
Plan coordinated remediation with security.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Azure Application Gateway?

It is a cloud-based web traffic load balancer that acts as a gatekeeper for applications. It manages incoming internet traffic, handles SSL termination, and routes requests to the appropriate backend servers to ensure reliable and scalable web service delivery.

What does CVE-2025-64657 mean by a stack-based buffer overflow?

This refers to CWE-787, where the software writes more data to a memory area than it can hold. Because this memory is on the 'stack,' it can overwrite critical program instructions. In this CVE, an attacker uses this memory error to gain unauthorized control or elevated privileges.

How does an attacker trigger this vulnerability?

An attacker sends specifically formatted or malicious network traffic to the gateway. The vulnerability is not triggered by normal, valid traffic patterns; it requires input designed to overwhelm the software's memory management to cause the overflow.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-priority concern because Azure Application Gateway is designed as an internet-facing edge service. Since it sits at the network perimeter to receive public traffic, the attack surface is exposed by its very nature.

What should I do to respond to this vulnerability?

First, create an inventory of all your Application Gateway instances to confirm which ones are public-facing. Once identified, coordinate with your cloud infrastructure team to review the status of these assets and plan the necessary steps for remediation.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64657

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.