Razer Synapse 3 CVE-2025-9870

Requires the attacker to already have the ability to execute low-privileged code on the target (local foothold). The specific trigger is the Razer Synapse 3 Philips HUE module installer/uninstaller performing a file operation that follows an attacker-created symbolic link, enabling arbitrary file deletion as a privileged process. Affected product is Razer Synapse 3 on Windows, which generally implies installed Razer peripheral software. Limiting factors: no remote vector (local access mandatory), the privileged installer/uninstall routine must be invoked, and the attacker needs filesystem write access to plant the symlink in the targeted location.

This is a credible but second-tier priority. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N, base 7.8 HIGH) correctly characterizes a local privilege escalation: an attacker must already run low-privileged code on the host, so there is no remote or network exposure despite the full C:H/I:H/A:H impact (abuse of an arbitrary-file-delete primitive to reach SYSTEM). The exploitation signals are weak-to-moderate: EPSS is only 0.19% (8th percentile), this CVE is NOT in CISA KEV, and no public exploit code is referenced - only the ZDI advisory. These signals are consistent with each other (low probability + no confirmed exploitation + no POC) rather than conflicting, so there is no evidence of active or widespread abuse. The 'RCE' tag overstates reach: the CVSS vector is AV:L and the description explicitly scopes this to local attackers, so it is local-only code execution as SYSTEM, not remote code execution - treat it as an LPE for patch-prioritization. Net: a real local EoP worth patching on a normal cycle, not an emergency, as it requires a foothold the attacker must already have obtained.

A low-privileged user (or malware already running as a standard user) plants a symbolic link that redirects a file operation performed by the Razer Synapse 3 Philips HUE module installer/uninstaller. When the privileged installer process follows the link, it deletes an attacker-chosen file, which is leveraged to gain code execution as SYSTEM. No public exploit code is referenced, and exploitation requires prior local access with the ability to run low-privileged code.