CVE-2025-29795
Published: 23 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-29795 is an improper link resolution before file access vulnerability, commonly referred to as 'link following', affecting Microsoft Edge (Chromium-based). Published on 2025-03-23, the issue is classified under CWE-59 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an authorized local attacker possessing low privileges. Exploitation requires local access and low complexity with no user interaction, enabling the attacker to elevate privileges and achieve high confidentiality, integrity, and availability impacts on the targeted system.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29795 provides details on patches and mitigation steps.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a local privilege escalation vulnerability (CWE-59 link following) in Microsoft Edge that allows a low-privileged local attacker to elevate privileges with high impact on confidentiality, integrity, and availability, directly mapping to exploitation for privilege escalation.