EUVD-2025-17770CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation vulnerability in Windows Installer that exploits improper symlink/junction handling (CWE-59: link following) to allow an authorized local attacker to elevate privileges without user interaction. With a CVSS score of 7.8 and CVSS vector indicating local attack vector with low complexity and no user interaction required, this vulnerability affects Windows Installer across multiple versions. Real-world risk depends on KEV/CISA status and EPSS probability, which should be cross-referenced against active exploitation reports and POC availability.
Technical ContextAI
This vulnerability exploits improper link resolution in Windows Installer (msiexec.exe and related MSI processing components), which fails to properly validate symbolic links or NTFS junctions before file access operations during package installation. CWE-59 (Link Following) describes the root cause: the application follows a link (symlink/junction) to a file without verifying the link's target is legitimate. Windows Installer processes MSI packages with SYSTEM privileges in certain contexts, creating a Time-of-Check-Time-of-Use (TOCTOU) window where an attacker can replace legitimate file paths with links pointing to sensitive system locations (e.g., %SystemRoot%, %ProgramFiles%, registry hives). The vulnerability is exacerbated because authorized users (PR:L in CVSS vector) can trigger MSI installations, and the installer's file operations are not confined by strict path validation or link-aware APIs.
RemediationAI
- PATCH: Apply Microsoft security updates addressing CVE-2025-33075 via Windows Update or Microsoft Update Catalog (KB article TBD—check Microsoft Security Response Center). 2. PRIORITIZE: Treat as high-priority patching given privilege escalation severity. 3. WORKAROUNDS (if patch delayed): (a) Restrict MSI installation privileges via Group Policy ('Disable Windows Installer' or 'Always install with elevated privileges' policies—though caveat: these may break legitimate installs); (b) Monitor %TEMP% and installation directories for suspicious symlink/junction creation (detection evasion technique); (c) Require administrative approval for all MSI installations (increases friction but reduces attack surface). 4. DETECTION: Implement file system monitoring for symlink/junction creation in installer working directories and temporary paths; correlate with MSI installation attempts. 5. REFERENCE: Consult Microsoft Security Update Guide and relevant KB articles for patch availability and version-specific guidance.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Share
External POC / Exploit Code
Leaving vuln.today