Windows Shell CVE-2025-64658

Requires the attacker to already have low-privileged local code execution on the target Windows host (AV:L, PR:L) - this is not remotely exploitable. Exploitation further depends on winning a race condition in the Windows Shell shared-resource handling (AC:H, a timing-sensitive TOCTOU window that may need many attempts) AND on victim user interaction (UI:R), such as a user performing a normal shell/file operation that the attacker races. These three limiting factors - local access, unreliable race timing, and required user action - substantially constrain realistic exploitation despite the SYSTEM-level (S:C, C:H/I:H/A:H) impact. Affected: Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025; multi-user or RDP/terminal-server hosts are the highest-value targets since attacker footholds are more common there.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 7.5) describes a local, high-complexity elevation-of-privilege flaw: the attacker must already have low-privilege access (PR:L), must win a timing-dependent race condition (AC:H, consistent with CWE-362), and requires a victim user action (UI:R). The scope change (S:C) plus full C:H/I:H/A:H reflects escalation from the Windows Shell context to SYSTEM/OS-level control. Countervailing signals lower the real-world urgency: there is NO EPSS score, NO CISA KEV listing, and NO public exploit code - status is 'no public exploit identified at time of analysis.' No SSVC decision data is provided. The only reference is the MSRC advisory, which is advisory-only with no technical detail. Net: this is a genuinely high-impact-if-exploited local EoP, but the combination of AC:H (must win a race), UI:R (needs user interaction), and PR:L (needs a foothold) makes reliable exploitation hard, and the absence of KEV/EPSS/POC suggests it is not currently a widespread or automated threat. Treat as a standard Patch-Tuesday EoP: patch in normal cycle, prioritize on multi-user/terminal-server hosts where local footholds are common. NOTE: input Tags label this 'Information Disclosure,' which contradicts the description (privilege elevation) and the C:H/I:H/A:H vector - the label appears wrong.

A low-privileged local user (or malicious code running in a standard-user session) plants a payload and repeatedly triggers a Windows Shell operation, racing a shared-resource window (TOCTOU) while inducing a victim to perform a normal shell action such as opening a folder or file. Winning the race lets the attacker substitute a resource and cause the Shell to act with SYSTEM privileges, escalating from standard user to full OS control. No public proof-of-concept exploit is currently identified, and the high attack complexity (winning the race) plus required user interaction make exploitation non-trivial.