What is the CVSS score of CVE-2025-7619?

CVE-2025-7619 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Windows are affected by CVE-2025-7619?

CVE-2025-7619 affects BatchSignCS, a Windows background application that could allow attackers to write arbitrary files and execute code on affected systems if users visit malicious websites.

How to fix or mitigate CVE-2025-7619?

Within 24 hours: Inventory all systems running BatchSignCS and assess user exposure to web browsing. Within 7 days: Implement network-level mitigations (disable BatchSignCS if non-critical, restrict outbound HTTP/HTTPS, or isolate affected systems). Within 30 days: Monitor vendor communications for patch availability and develop deployment plan; conduct security awareness training on malicious website risks.

Windows CVE-2025-7619

EUVD-2025-21300 HIGH

Relative Path Traversal (CWE-23)

2025-07-14 twcert@cert.org.tw

Windows RCE Microsoft

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21300

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

CVE Published

Jul 14, 2025 - 04:15 nvd

HIGH 8.8

DescriptionCVE.org

BatchSignCS, a background Windows application developed by WellChoose, has an Arbitrary File Write vulnerability. If a user visits a malicious website while the application is running, remote attackers can write arbitrary files to any path and potentially lead to arbitrary code execution.

AnalysisAI

CVE-2025-7619 is an Arbitrary File Write vulnerability in BatchSignCS, a background Windows application by WellChoose, that allows remote attackers with low privileges to write arbitrary files to any filesystem path via malicious website visits, potentially enabling arbitrary code execution. The vulnerability has a CVSS score of 8.8 (High) and requires user interaction (visiting a malicious site) but no elevated privileges; real-world exploitability depends on KEV listing status and public POC availability, which are not confirmed in the provided data.

Technical ContextAI

BatchSignCS is a Windows background service developed by WellChoose that appears to process or sign batch operations. The vulnerability stems from CWE-23 (Relative Path Traversal), indicating improper sanitization of file path inputs that could allow an attacker to traverse directory structures and write files outside intended directories. The attack vector is Network (AV:N), suggesting the application processes untrusted input from web sources without proper validation. The root cause is likely insufficient input validation when handling file write operations triggered by web-based interactions, allowing path traversal sequences (e.g., ../ or absolute paths) to reach arbitrary filesystem locations.

RemediationAI

IMMEDIATE: Disable or uninstall BatchSignCS if not critical to operations until a patch is released. 2. NETWORK MITIGATION: Restrict network access to BatchSignCS processes using Windows Firewall rules to limit inbound connections from untrusted sources. 3. MONITOR: Watch for suspicious file write operations to unusual paths on systems running BatchSignCS. 4. PATCH: Contact WellChoose for security updates and patch availability; monitor vendor security advisories at [vendor website/security bulletin location not provided in source data]. 5. WORKAROUND: If available, disable web-triggered file operations in BatchSignCS configuration pending patching. 6. PRINCIPLE OF LEAST PRIVILEGE: Ensure BatchSignCS runs with minimal necessary Windows permissions to limit the scope of arbitrary file writes.