EUVD-2025-17790CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation vulnerability in Windows Recovery Driver caused by improper symlink/hardlink resolution (CWE-59: link following) that allows an authenticated local attacker to elevate privileges to SYSTEM level. The vulnerability requires user interaction and local code execution capability but provides complete system compromise once exploited. With a CVSS score of 7.3 and local attack vector, this poses significant risk to multi-user Windows systems, particularly in enterprise environments where standard users have local access.
Technical ContextAI
This vulnerability exploits a classic link-following flaw in the Windows Recovery Driver, a kernel-mode component responsible for system recovery and repair operations. The root cause (CWE-59: Improper Link Resolution Before File Access) occurs when the driver fails to properly validate whether a file path target is a symbolic link or hard link before performing privileged file operations. An attacker with local user privileges can create crafted symlinks or hardlinks pointing to protected system files or directories, causing the Recovery Driver to perform unauthorized read/write operations with kernel privileges. The vulnerability likely exists in file I/O handling routines that don't use proper kernel APIs (such as those that prevent following reparse points or checking link targets before access). Affected systems are Windows operating systems containing vulnerable versions of the Recovery Driver component, though specific CPE identifiers would typically be: cpe:2.3:o:microsoft:windows_10:* and cpe:2.3:o:microsoft:windows_11:* (with specific version constraints depending on patch deployment).
RemediationAI
Apply the official Microsoft security patch immediately upon release via Windows Update or WSUS for managed environments. (1) Patch Application: Download and install the cumulative security update for your Windows version from Microsoft Update Catalog or MSRC. (2) Workarounds (temporary, until patching): Restrict local user account privileges where feasible; disable or minimize use of Windows Recovery features if not required; implement AppLocker/Windows Defender Application Control policies to restrict execution of untrusted applications that could create symlinks; use Windows Sandbox or Hyper-V isolated containers for untrusted workloads. (3) Mitigation: Enable Windows Defender Exploit Guard/ASR (Attack Surface Reduction) rules if applicable; monitor creation of suspicious symlinks in system directories via Sysmon or EDR solutions; enforce principle of least privilege to reduce standard user capabilities. (4) Patch Verification: After patching, verify via Windows Update history or 'winver' command and cross-reference patch KB number with MSRC advisory. For detailed patch KB number and download links, consult: https://msrc.microsoft.com/update-guide/ and search CVE-2025-32721.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Share
External POC / Exploit Code
Leaving vuln.today