Cyber Posture

CVE-2025-25008

High

Published: 11 March 2025

Published
11 March 2025
Modified
01 July 2025
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0029 52.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-25008 is a vulnerability involving improper link resolution before file access, known as "link following," in Microsoft Windows. Published on 2025-03-11, it enables an authorized local attacker to elevate privileges and has a CVSS v3.1 base score of 7.1 (High), with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The issue maps to CWE-59: Improper Link Resolution Before File Access.

A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows the attacker to achieve high integrity (I:H) and availability (A:H) impacts, specifically enabling local privilege escalation on the affected Windows system.

Mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25008.

Details

CWE(s)
CWE-59

Affected Products

microsoft
windows server 2016
≤ 10.0.14393.7876
microsoft
windows server 2019
≤ 10.0.17763.7009
microsoft
windows server 2022
≤ 10.0.20348.3328
microsoft
windows server 2022 23h2
≤ 10.0.25398.1486
microsoft
windows server 2025
≤ 10.0.26100.3476

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The CVE describes a local privilege escalation vulnerability in Windows due to improper link resolution (CWE-59), directly enabling exploitation to gain higher privileges on the system, which maps to T1068.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References