JetBrains ReSharper CVE-2025-64457

Requires the attacker to already have a local, low-privileged account on a machine running a vulnerable version (ReSharper, Rider, or dotTrace before 2025.2.5) and to win a TOCTOU race condition (CWE-367) against a higher-privileged operation - a non-deterministic timing window (AC:H) that typically demands repeated attempts. Exploitation is limited by: no remote/network vector (AV:L), the need for existing local access (PR:L), and the inherent unreliability of race-condition exploitation. No user interaction is required (UI:N). Realistically confined to multi-user or developer endpoints where the affected tool or its elevated helper/installer/updater is present.

This is a genuinely local, hard-to-exploit issue that scores 7.0 largely because of the high triple-impact (C:H/I:H/A:H) rather than easy reachability. The CVSS vector is internally consistent with the description: AV:L (local access to the host running the JetBrains tool), AC:H (race condition/TOCTOU per CWE-367 requires winning a timing window, so exploitation is non-deterministic), PR:L (an existing low-privileged local user), UI:N and S:U. EPSS is 0.00% (0th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis.' All signals point the same direction: real but low real-world priority. It is not a remotely reachable or automatable bug; it needs a foothold on the machine and a successful race, which typically means repeated attempts. There is no conflict between the signals here - CVSS, EPSS, and the absence of KEV/POC all agree this is a low-urgency local privesc affecting developer/profiling tooling rather than internet-facing infrastructure. The main caveat is that the vendor advisory is a generic 'issues fixed' page with sparse technical detail, so the exact vulnerable component (which of ReSharper, Rider, dotTrace) and the mechanism of the race are not independently detailed.

A low-privileged local user on a workstation where a vulnerable JetBrains product (ReSharper, Rider, or dotTrace before 2025.2.5) runs, or its installer/updater/service operates at higher privilege, repeatedly triggers a time-of-check to time-of-use race - for example swapping a file or symlink between validation and use - to have their content acted on with elevated privileges. Winning the timing window yields code execution or file operations at the higher privilege level, escalating to full compromise of the account/service context. No public proof-of-concept exploit is referenced, and the high attack complexity means success requires many attempts.