What is the CVSS score of CVE-2025-32714?

CVE-2025-32714 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows are affected by CVE-2025-32714?

CVE-2025-32714 is a local privilege escalation vulnerability in Windows Installer affecting multiple Windows versions that allows any authenticated local user to gain elevated system privileges…. A patch is available.

How to fix or mitigate CVE-2025-32714?

Within 24 hours: Identify all Windows systems running affected Windows Installer versions in your environment and document current patch levels. Within 7 days: Apply vendor-released patch to all systems-prioritize servers and workstations where non-administrative users have local login access. Within 30 days: Verify patch deployment across 100% of affected systems through patch management tools; audit local user account policies to minimize accounts with local logon rights.

Windows CVE-2025-32714

EUVD-2025-17788 HIGH

Improper Access Control (CWE-284)

2025-06-10 secure@microsoft.com

Microsoft Windows Privilege Escalation Windows 11 24h2 Windows Server 2022 23h2 Windows 11 23h2 Windows 10 1507 Windows 10 22h2 Windows Server 2012 Windows Server 2025 Windows 10 1607 Windows Server 2022 Windows 10 1809 Windows Server 2016 Windows 11 22h2 Windows 10 21h2 Windows Server 2019 Windows Server 2008

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:42 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.2.9200.25522,6.0.6003.23351,10.0.14393.8148

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17788

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:21 nvd

HIGH 7.8

DescriptionCVE.org

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation vulnerability in Windows Installer caused by improper access control (CWE-284) that allows an authorized local attacker to elevate privileges without user interaction. The vulnerability affects Windows Installer components across multiple Windows versions and has a CVSS score of 7.8 (High severity). Without confirmation of KEV status or active exploitation data, the high CVSS vector (Low attack complexity, Low privileges required) indicates this represents a significant risk to systems where local user accounts exist.

Technical ContextAI

Windows Installer (MSI engine) is a core Windows component responsible for application installation and management. The vulnerability stems from improper access control mechanisms (CWE-284: Improper Access Control) within the installer's privilege escalation routines. Specifically, the flaw likely exists in the MSI service's handling of installer contexts or in the validation of installer package permissions, allowing a standard user to manipulate installer operations in ways that lead to SYSTEM-level code execution. The attack likely exploits gaps between file/registry permission checks during MSI processing, where an attacker with local user access can interact with privileged installer operations without adequate authorization controls.

RemediationAI

Apply the official Microsoft security patch immediately via Windows Update or WSUS for affected Windows versions. 2. If patch is unavailable, implement access control mitigations: restrict local user account creation/privileges, disable unnecessary installer services, and enforce AppLocker/Windows Defender Application Control policies to restrict MSI execution. 3. Monitor Event Viewer for unusual Windows Installer activity (Event ID 11707, 11708 for installation events; security event logging for privilege escalation attempts). 4. For environments requiring elevated security: disable user-initiated MSI installations via Group Policy (set 'Disable Windows Installer' or restrict to admin-approved packages only). 5. Verify patch deployment across all systems using Microsoft Update compliance tools and SCCM/Intune reporting. Consult Microsoft Security Update Guide (https://msrc.microsoft.com/) for specific KB numbers and patch versions.