Windows 11 CVE-2025-59241

Exploitation requires the attacker to already have local, authenticated low-privileged access (PR:L) to a Windows 11 24H2 or 25H2 host where the Health and Optimized Experiences Service is present and running (a default component). The attacker must be able to create or manipulate filesystem links (symbolic links, junctions, or hardlinks) that the privileged service resolves, then win the file-access timing against that service. Limiting factors: there is NO remote attack vector (AV:L) and no path to exploitation from the network or an unauthenticated position; the attacker needs an existing foothold on the machine first, which makes this a post-compromise escalation primitive rather than an initial-access vulnerability. No user interaction is required (UI:N).

This is a CVSS 7.8 (HIGH) local privilege escalation. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) tells a consistent story: the attacker must already have local, low-privileged access to the machine (PR:L), but once there, exploitation is low-complexity (AC:L), needs no user interaction (UI:N), and yields full high-impact compromise of confidentiality, integrity, and availability - i.e. SYSTEM-level elevation. The real-world signals argue against treating this as an emergency, however: EPSS is only 0.35% (27th percentile), it is NOT on CISA KEV, and no public exploit code was identified. So the raw severity is driven by impact, not by demonstrated or probable exploitation. There is no conflict between the network/local signals here - the vector and the description both clearly describe LOCAL exploitation. The main caveat is the input Tags labeling this 'Information Disclosure,' which contradicts both the description ('elevate privileges locally') and the full C/I/A impact - this is an elevation-of-privilege flaw, not an info-disclosure one. Treat as a standard patch-cycle priority: it is a useful second-stage/post-compromise primitive for an attacker who already has a foothold, rather than a drive-by remote threat.

An attacker who already has a low-privileged account or code execution on a Windows 11 (24H2/25H2) host abuses a symbolic-link / junction race against the Health and Optimized Experiences Service, redirecting a privileged file operation to a location the attacker controls. Because the service runs with elevated rights, this lets the attacker write or overwrite a protected file and escalate to SYSTEM. No public proof-of-concept exploit was identified at time of analysis, and no user interaction is required once local access is obtained.