What is the CVSS score of CVE-2025-49797?

CVE-2025-49797 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-49797?

Brother printer and scanner driver installers for Windows contain a privilege escalation vulnerability that could allow attackers to gain administrative access to affected systems.

How to fix or mitigate CVE-2025-49797?

Within 24 hours: Identify all Brother printer/scanner models and driver versions in use across the organization and cross-reference against Brother's official vulnerability advisory to determine exposure scope. Within 7 days: Restrict driver installation privileges to IT administrators only, disable user-level driver installation capabilities via Group Policy where possible, and communicate the vulnerability to all users with guidance to avoid installing drivers from untrusted sources. Within 30 days: Monitor Brother's security advisories for patch availability and establish a rapid deployment process; consider alternative device vendors for future procurement if patches remain unavailable; conduct forensic review of any recent driver installations for signs of exploitation.

Windows CVE-2025-49797

EUVD-2025-19089 HIGH

Files or Directories Accessible to External Parties (CWE-552)

2025-06-25 vultures@jpcert.or.jp

Microsoft Privilege Escalation Windows

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19089

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 10:15 nvd

HIGH 7.8

DescriptionCVE.org

Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

AnalysisAI

CVE-2025-49797 is a privilege escalation vulnerability in multiple Brother device driver installers for Windows that allows a local attacker with limited user privileges to execute arbitrary code with administrative rights without user interaction. The vulnerability affects various Brother printer and multifunction device driver packages across multiple versions. While the CVSS score of 7.8 indicates significant severity, real-world exploitability depends on whether an attacker has local access to a system during driver installation or can manipulate installer processes.

Technical ContextAI

This vulnerability (CWE-552: Files or Directories Accessible to External Parties) resides in Brother's Windows driver installer packages. CWE-552 indicates improper file/directory permissions or access controls, typically where installer components fail to properly restrict access to temporary files, installation directories, or configuration files during the installation process. Brother driver installers likely execute with elevated privileges during setup, and if the installer fails to properly validate or restrict access to files it reads or writes—such as configuration files, temporary installation files, or DLL loading paths—a local attacker can exploit insecure file handling to inject malicious code. The attack likely involves DLL hijacking, file replacement during installation, or exploitation of race conditions in the installer's file operations. Affected products include Brother printer drivers (MFC, HL, DCP, and other series), though specific CPE strings and version ranges require reference to Brother's official security advisory. The vulnerability impacts Windows systems where Brother device drivers are installed or updated.

RemediationAI

Remediation steps: (1) Consult Brother's official security advisory (referenced in CVE details) to identify specific affected driver versions and safe replacement versions. (2) Download patched driver versions directly from Brother's official support website, verifying version numbers against the advisory. (3) Install patched drivers with administrative privileges in a controlled manner, avoiding automated or unattended installations until patches are confirmed. (4) For affected systems, perform a fresh driver installation after removing old driver versions completely (use Device Manager to uninstall, then remove residual files). (5) Apply principle of least privilege: ensure user accounts installing software operate with minimal required permissions. (6) Workaround (temporary): delay driver installation/updates until patched versions are available; if driver replacement is unavoidable, use isolated administrative sessions and monitor for suspicious behavior. (7) Monitor Brother's security page and firmware release notes for patch availability. (8) For enterprise deployments, test patched drivers in isolated environments before wide rollout. References and patch links will be available at Brother's official security advisory pages (typically brother.com/support or similar).