EUVD-2025-17790Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation vulnerability in Windows Recovery Driver caused by improper symlink/hardlink resolution (CWE-59: link following) that allows an authenticated local attacker to elevate privileges to SYSTEM level. The vulnerability requires user interaction and local code execution capability but provides complete system compromise once exploited. With a CVSS score of 7.3 and local attack vector, this poses significant risk to multi-user Windows systems, particularly in enterprise environments where standard users have local access.
Technical ContextAI
This vulnerability exploits a classic link-following flaw in the Windows Recovery Driver, a kernel-mode component responsible for system recovery and repair operations. The root cause (CWE-59: Improper Link Resolution Before File Access) occurs when the driver fails to properly validate whether a file path target is a symbolic link or hard link before performing privileged file operations. An attacker with local user privileges can create crafted symlinks or hardlinks pointing to protected system files or directories, causing the Recovery Driver to perform unauthorized read/write operations with kernel privileges. The vulnerability likely exists in file I/O handling routines that don't use proper kernel APIs (such as those that prevent following reparse points or checking link targets before access). Affected systems are Windows operating systems containing vulnerable versions of the Recovery Driver component, though specific CPE identifiers would typically be: cpe:2.3:o:microsoft:windows_10:* and cpe:2.3:o:microsoft:windows_11:* (with specific version constraints depending on patch deployment).
RemediationAI
Apply the official Microsoft security patch immediately upon release via Windows Update or WSUS for managed environments. (1) Patch Application: Download and install the cumulative security update for your Windows version from Microsoft Update Catalog or MSRC. (2) Workarounds (temporary, until patching): Restrict local user account privileges where feasible; disable or minimize use of Windows Recovery features if not required; implement AppLocker/Windows Defender Application Control policies to restrict execution of untrusted applications that could create symlinks; use Windows Sandbox or Hyper-V isolated containers for untrusted workloads. (3) Mitigation: Enable Windows Defender Exploit Guard/ASR (Attack Surface Reduction) rules if applicable; monitor creation of suspicious symlinks in system directories via Sysmon or EDR solutions; enforce principle of least privilege to reduce standard user capabilities. (4) Patch Verification: After patching, verify via Windows Update history or 'winver' command and cross-reference patch KB number with MSRC advisory. For detailed patch KB number and download links, consult: https://msrc.microsoft.com/update-guide/ and search CVE-2025-32721.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today