Windows NTLM CVE-2025-59284

Exploitation requires LOCAL interaction on an affected host - the attacker must either already have local access or induce a logged-on user to perform an action (UI:R), such as opening a malicious file or UI element, that causes Windows NTLM to expose sensitive information. No elevated privileges are needed beforehand (PR:N), but the mandatory user interaction and the Local (non-network) attack vector are the key limiting factors that constrain realistic exploitation to scenarios where an attacker can present content to a victim on the machine. It is not remotely/network exploitable and does not work unattended against a default configuration without a user acting.

This is a moderate-severity information-disclosure/spoofing flaw rated CVSS 5.5. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) tells a consistent story: exploitation requires LOCAL access and USER INTERACTION, but no prior privileges (PR:N), and yields high confidentiality impact with no integrity or availability effect. The description ('perform spoofing locally') and the CVSS Local attack vector agree - this is not remotely exploitable over a network, which materially caps real-world risk. EPSS is 1.03% (63rd percentile), indicating low-to-modest predicted exploitation probability, and it is NOT listed in CISA KEV, with no public exploit identified at time of analysis. These signals are mutually consistent: no evidence of active exploitation, low automatability, and a local+user-interaction prerequisite together place this well below network-facing critical bugs despite affecting ubiquitous Windows platforms. The characterization as 'spoofing' alongside a C:H/I:N confidentiality-only impact (CWE-200) is slightly dissonant - the primary technical effect is sensitive-information exposure (likely NTLM credential/hash material) that then enables spoofing - verify the exact disclosed data with Microsoft's advisory. Overall: a real but second-tier patching priority, meaningful mainly because it affects every supported Windows 11 build and Server 2025, not because of imminent mass exploitation.

An attacker with local access, or who lures a logged-on user into opening a crafted file or shortcut, triggers NTLM to leak sensitive authentication information (consistent with the Local vector and required user interaction). The disclosed material can then be used to spoof or impersonate the victim in subsequent authentication. No public exploit code has been identified at the time of analysis.