CVE-2025-58074
Published: 04 May 2026
Description
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevation of…
more
privileges.
Security SummaryAI
CVE-2025-58074 is a privilege escalation vulnerability affecting the installation process of Norton Secure VPN when downloaded via the Microsoft Store. During installation, a low-privilege user can replace files, potentially leading to the deletion of arbitrary files and subsequent elevation of privileges. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-1386.
A low-privilege local user can exploit this vulnerability by interfering with the file replacement mechanism during the Norton Secure VPN installation from the Microsoft Store. Successful exploitation allows the attacker to delete arbitrary files, which can result in privilege escalation, granting higher-level access on the affected system and enabling confidentiality, integrity, and availability impacts.
Mitigation details and additional technical information are available in the Cisco Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2276.
Details
- CWE(s)