Razer Synapse
CVE-2025-9869
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged code execution on host
-
DeliveryCreate malicious symbolic link
-
ExploitTrigger Razer Synapse Service file operation
-
ExecutionService deletes arbitrary file as SYSTEM
-
ImpactLeverage delete primitive for SYSTEM code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires Razer Synapse 3 installed on the target Windows host with its SYSTEM-privileged Razer Synapse Service running (the default state after installation), and the attacker must already possess the ability to execute low-privileged code locally on that host (PR:L) - this is the primary limiting factor, as there is no remote or unauthenticated path (AV:L). Exploitation hinges on the service's Macro Module following an attacker-created symbolic link during a file operation; no user interaction is needed (UI:N). Realistic risk is confined to multi-user systems or scenarios where an attacker has already gained an initial low-privilege foothold. |
| Impact | This is a legitimate but context-limited priority. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 HIGH) describes a local privilege escalation: the attacker needs local, low-privileged code execution (AV:L, PR:L) but then achieves full SYSTEM compromise (C:H/I:H/A:H) with low attack complexity (AC:L). All signals are internally consistent - the description's statement that 'an attacker must first obtain the ability to execute low-privileged code' matches AV:L/PR:L exactly, so there is no network-vs-local or auth conflict to reconcile. The EPSS score is low at 0.19% (8th percentile), which is expected and NOT contradictory: EPSS predicts broad remote exploitation activity, and LPE bugs structurally score low there because they require prior local access and are not wormable. There is no CISA KEV listing and no public exploit code referenced (only the ZDI advisory), so this is not confirmed active exploitation. No SSVC decision data was provided in the input. Net read: a real, well-documented second-stage escalation primitive useful to attackers who already have a foothold, but not a drop-everything internet-facing emergency. Prioritize patching on systems where untrusted local users run code, below any unauthenticated-RCE issues. |
| Exploit ScenarioDerived | An attacker who already has low-privileged code execution on a Windows host running Razer Synapse 3 plants a symbolic link that redirects a file operation performed by the SYSTEM-level Razer Synapse Service, causing it to delete an arbitrary attacker-chosen file. The attacker weaponizes this arbitrary-delete primitive into arbitrary code execution as SYSTEM, achieving full privilege escalation. No public exploit code is referenced in the input, though the flaw was discovered and detailed by Trend Micro's Zero Day Initiative (ZDI-25-919 / ZDI-CAN-26374). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local privilege escalation in Razer Synapse 3 lets an attacker who already has low-privileged code execution on a Windows host abuse the SYSTEM-privileged Razer Synapse Service's Macro Module to follow an attacker-created symbolic link, causing the service to delete arbitrary files and ultimately execute code as SYSTEM. Exploitation requires Synapse 3 installed with its service running (the default state after installation) and local access only - the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so there is no remote or unauthenticated path and no user interaction is needed. Risk is real but context-limited: EPSS is 0.19% (8th percentile), the flaw is not in CISA KEV, and no public exploit code has been identified at time of analysis; practical exposure is confined to multi-user systems or environments where an attacker has already gained an initial low-privilege foothold.
RemediationAI
No vendor-released patch has been identified at time of analysis; the only reference in the provided data is the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-919/), which should be consulted for Razer's fix timeline and any updated Synapse 3 installer version before assuming remediation is available - verify rather than assume, and upgrade to the first vendor-published fixed build once confirmed. Because exploitation depends on local low-privilege code execution, the most effective compensating control is reducing that precondition: enforce least privilege so standard users cannot run arbitrary code on hosts with Synapse installed, and restrict interactive logon and RDP access on multi-user or shared machines where a foothold is plausible. Where Synapse is not operationally required, uninstalling Synapse 3 or excluding it from sensitive/multi-user images removes the attack surface entirely, at the cost of losing peripheral configuration, macro, and RGB control functionality. If the product must remain, harden the symlink primitive by restricting SeCreateSymbolicLinkPrivilege through Group Policy so ordinary users cannot create reparse points - the trade-off is that legitimate developer and application symlink workflows will break - and deploy EDR or file-integrity monitoring focused on creation of symbolic links and unexpected deletions within Razer Synapse install and service data directories, which may generate noise but will surface exploitation attempts. Running Synapse on dedicated, non-persistent, non-shared workstations and keeping the service stopped when not actively configuring peripherals further narrows the window, though stopping the service degrades peripheral configuration until it is restarted. Given the 7.8 severity and SYSTEM-level impact, treat any low-privilege code execution on a Synapse-bearing host as a potential full-host compromise and prioritize credential rotation and reimaging for such systems.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-59 (Improper Link Resolution Before File Access, i.e. link following), a TOCTOU-style flaw in which a privileged process performs a file operation on a path an unprivileged user can influence. Here the Razer Synapse Service - which runs as SYSTEM - is reached through the Synapse 3 Macro Module code path, and by planting a symbolic link (a reparse point) an attacker causes the service to operate on an attacker-chosen target instead of the intended file, resulting in arbitrary file deletion with SYSTEM privileges. Arbitrary deletion of files owned or protected at SYSTEM level enables privilege escalation, for example by removing or replacing content the service then consumes, which the disclosure characterizes as leading to code execution in the SYSTEM context (ZDI-CAN-26374 / ZDI-25-919). The CPE data (cpe:2.3:a:razer:synapse:*:*:*:*:*:*:*:*) is a wildcard on version, so the affected scope is effectively any installed build of Razer Synapse; the component is Windows-specific given the service architecture and the symlink-based exploitation primitive. Note that on Windows, creating symbolic links often requires elevated rights or Developer Mode, a nuance that reinforces the assessment's framing of this as a post-compromise, locally-scoped escalation rather than a widely reachable attack.
Know when Synapse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local foothold with low-privileged code required so AV:L/PR:L; the symbolic-link primitive is reliably triggerable (AC:L) and yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Razer Synapse Service. By creating a symbolic link, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26374.
Executive ViewAI
A local privilege-escalation flaw in Razer Synapse 3 (CVE-2025-9869, CVSS 7.8) allows anyone who already holds a low-privilege foothold on a Windows endpoint to escalate to full SYSTEM control by abusing the always-running Razer Synapse Service. Because the affected service is installed and running by default on every host with Synapse 3, the exposure base is broad, but exploitation is not remote and cannot occur without a pre-existing local compromise - meaning multi-user workstations, shared engineering or gaming builds, and VDI environments carry the most realistic risk. Leadership should care because a SYSTEM-level escalation turns a contained, low-severity foothold into a domain-relevant compromise, and no vendor patch is currently available, so risk must be managed through configuration and inventory controls.
No vendor-released patch identified at time of analysis. Interim mitigations: stop and disable the Razer Synapse Service or uninstall Razer Synapse 3 on hosts where it is not required (highest priority on multi-user, shared, and VDI systems); enforce least privilege so standard users cannot obtain a local code-execution foothold; restrict local interactive logon to trusted personnel; apply application allowlisting to prevent unapproved binary execution; and enable EDR or Windows auditing to detect symbolic-link creation and file deletion performed by the SYSTEM-privileged Razer Synapse Service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpe
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). Rated critical seve
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Rated critical severity (CVSS 9.8), t
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by le
Synapse is an open source Matrix homeserver implementation. Rated high severity (CVSS 7.1), this vulnerability is remote
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users t
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Rated medium severity (
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Rated high severity (CVSS 8.2)
Local privilege escalation in Razer Synapse 3 lets an attacker who already holds a low-privileged foothold on a Windows
Local privilege escalation in Razer Synapse 3 allows an attacker who already holds a low-privileged foothold on a Window
GitHub PoC
Exploit-DB