CVE-2025-21292

CVE-2025-21292 is a Windows Search Service Elevation of Privilege Vulnerability, published on 2025-01-14T18:15:50.927. It affects the Windows Search Service component in Microsoft Windows operating systems and is associated with CWE-94 (Code Injection) and NVD-CWE-noinfo. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to local attack vector, low complexity, low privileges required, no user interaction, changed scope, and high impacts across confidentiality, integrity, and availability.

A local attacker with low-level privileges can exploit this vulnerability through the Windows Search Service. Exploitation requires low complexity and no user interaction. Successful attacks enable privilege escalation, allowing the attacker to achieve high impacts on system confidentiality, integrity, and availability with a scope change.

Microsoft's advisory provides guidance on this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21292, where security practitioners can find details on patches and mitigation recommendations.