EUVD-2025-17790CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
Analysis
Privilege escalation vulnerability in Windows Recovery Driver caused by improper symlink/hardlink resolution (CWE-59: link following) that allows an authenticated local attacker to elevate privileges to SYSTEM level. The vulnerability requires user interaction and local code execution capability but provides complete system compromise once exploited. With a CVSS score of 7.3 and local attack vector, this poses significant risk to multi-user Windows systems, particularly in enterprise environments where standard users have local access.
Technical Context
This vulnerability exploits a classic link-following flaw in the Windows Recovery Driver, a kernel-mode component responsible for system recovery and repair operations. The root cause (CWE-59: Improper Link Resolution Before File Access) occurs when the driver fails to properly validate whether a file path target is a symbolic link or hard link before performing privileged file operations. An attacker with local user privileges can create crafted symlinks or hardlinks pointing to protected system files or directories, causing the Recovery Driver to perform unauthorized read/write operations with kernel privileges. The vulnerability likely exists in file I/O handling routines that don't use proper kernel APIs (such as those that prevent following reparse points or checking link targets before access). Affected systems are Windows operating systems containing vulnerable versions of the Recovery Driver component, though specific CPE identifiers would typically be: cpe:2.3:o:microsoft:windows_10:* and cpe:2.3:o:microsoft:windows_11:* (with specific version constraints depending on patch deployment).
Affected Products
Microsoft Windows operating systems with vulnerable Recovery Driver versions. Without access to the original CVE reference data, specific affected versions are not definitively listed here; however, typical scope includes: Windows 10 (multiple versions 21H2 and earlier, depending on patch release), Windows 11 (versions prior to patch release). The Recovery Driver is a core OS component present in all modern Windows NT-based systems. Enterprise and consumer endpoints running unpatched Windows 10/11 are at risk. Specific version constraints would be found in Microsoft Security Advisory/KB article associated with CVE-2025-32721 (e.g., KB5XXXXXX). Affected CPE: cpe:2.3:o:microsoft:windows_10:* (unpatched versions), cpe:2.3:o:microsoft:windows_11:* (unpatched versions). Vendor advisory and patch details should be obtained from Microsoft Security Response Center (MSRC) at https://msrc.microsoft.com/.
Remediation
Apply the official Microsoft security patch immediately upon release via Windows Update or WSUS for managed environments. (1) Patch Application: Download and install the cumulative security update for your Windows version from Microsoft Update Catalog or MSRC. (2) Workarounds (temporary, until patching): Restrict local user account privileges where feasible; disable or minimize use of Windows Recovery features if not required; implement AppLocker/Windows Defender Application Control policies to restrict execution of untrusted applications that could create symlinks; use Windows Sandbox or Hyper-V isolated containers for untrusted workloads. (3) Mitigation: Enable Windows Defender Exploit Guard/ASR (Attack Surface Reduction) rules if applicable; monitor creation of suspicious symlinks in system directories via Sysmon or EDR solutions; enforce principle of least privilege to reduce standard user capabilities. (4) Patch Verification: After patching, verify via Windows Update history or 'winver' command and cross-reference patch KB number with MSRC advisory. For detailed patch KB number and download links, consult: https://msrc.microsoft.com/update-guide/ and search CVE-2025-32721.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today