Razer Synapse CVE-2025-9871
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local code execution
-
ExploitPlant symbolic link targeting installer file operation
-
ExecutionTrigger Chroma SDK installer arbitrary file delete
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Exploitation requires an attacker to already possess the ability to run low-privileged code on a Windows host with Razer Synapse 3 (and the Razer Chroma SDK) installed. The concrete prerequisite is the ability to create a symbolic link that the privileged Razer Chroma SDK installer will follow during its file operations, abusing it to delete an arbitrary file and pivot to SYSTEM code execution. Limiting factors: this is not remotely exploitable (AV:L), it needs a pre-existing authenticated low-privileged session (PR:L), the vulnerable Razer Chroma SDK installer component must be present, and the privileged installer operation must execute while the planted link is in place - there is no user interaction requirement (UI:N). |
| Impact | This is a credible but moderate-priority local privilege escalation. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with the description: it correctly reflects local attack vector, low complexity, and a low-privileged attacker who already has code execution, with full C/I/A impact because the end state is SYSTEM-level code execution. The signals do NOT point to urgent, widespread exploitation: EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code is referenced - only the ZDI advisory. No SSVC decision data was provided in the input. The combination of a required pre-existing local foothold plus low EPSS and absent KEV means this is a real engineering bug worth patching on a normal cycle rather than an emergency, and is most relevant as a post-compromise escalation primitive rather than an initial-access vector. No signals are in direct conflict; the main gap is precise affected/fixed version data (the CPE is a wildcard), which should be verified against the Razer/ZDI advisory. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows system running Razer Synapse 3 plants a symbolic link that redirects a file operation performed by the privileged Razer Chroma SDK installer. When the installer runs (e.g., during an install/update), it follows the link and deletes an attacker-chosen file, which is leveraged to achieve arbitrary code execution as SYSTEM. No public proof-of-concept is referenced beyond the ZDI advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local privilege escalation in Razer Synapse 3 lets an attacker who already holds a low-privileged foothold on a Windows host escalate to SYSTEM by exploiting a link-following flaw in the Razer Chroma SDK installer. By planting a symbolic link that the privileged installer follows during its file operations, the attacker can force deletion of an arbitrary file and pivot to code execution in the SYSTEM context. Exploitation requires local access plus the ability to create a symlink and the vulnerable installer component to be present, with no user interaction needed; no public exploit code has been identified at time of analysis and the EPSS score is low (0.19%, 8th percentile), making this a credible but moderate-priority local escalation issue.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation currently relies on compensating controls pending an official Razer fix. Because the vulnerability hinges on the ability to create symbolic links that the elevated Chroma SDK installer follows, the most direct mitigation is to ensure standard users cannot create symlinks: verify that SeCreateSymbolicLinkPrivilege is not granted to the Users group, and disable Windows Developer Mode, which grants non-administrators symlink creation rights; the trade-off is that legitimate developer workflows and some tooling that depend on unprivileged symlink creation will break. If the Chroma SDK installer is not required, remove or disable that component so the vulnerable privileged file operation is never invoked, accepting loss of Chroma lighting/sync integration. Restrict software installation and update operations to administrators only, and monitor for symlink creation in installer and program-directory paths as a detection measure. Once Razer publishes a fixed Synapse build, upgrade to that exact version; monitor the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-920/ and Razer's Synapse release notes for the designated fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic link-following (symlink) vulnerability in the CWE-59 class, rooted in the Razer Chroma SDK installer component shipped with Razer Synapse 3. Because the installer runs with elevated privileges and performs file deletion or replacement operations on paths that a low-privileged process can influence, an attacker can interpose a symbolic link so that the privileged operation resolves to an unintended target. The attacker then abuses the resulting arbitrary-file-deletion primitive to remove a resource that the system subsequently recreates or loads, achieving code execution as SYSTEM. The CVSS v3.0/v3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack, low complexity, authenticated low-privileged prerequisites, no user interaction, and high confidentiality and integrity impact; the affected product is captured by the wildcarded CPE cpe:2.3:a:razer:synapse:*:*:*:*:*:*:*:*, indicating the vendor product rather than a single fixed version.
Know when Synapse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only symlink abuse by an existing low-privileged user (AV:L, PR:L, AC:L, UI:N) culminating in SYSTEM code execution yields full C/I/A impact with unchanged scope.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373.
Executive ViewAI
Razer Synapse 3, a peripheral configuration utility, contains a local privilege-escalation flaw in the Razer Chroma SDK installer that can allow an attacker with an existing low-privileged foothold on a Windows endpoint to gain SYSTEM-level control. Because the vulnerable component may be broadly installed on user workstations, and because no vendor-released patch identified at time of analysis, leadership should treat affected endpoints as at increased risk of full host compromise if an attacker gains any local access. No public exploit identified at time of analysis, and the low EPSS score suggests near-term exploitation is unlikely, so priority should focus on inventory, removal or isolation of unnecessary installations, and least-privilege hardening.
Remove or disable Razer Synapse 3 and the Razer Chroma SDK installer on managed Windows endpoints where not business-required; enforce least privilege by denying SeCreateSymbolicLinkPrivilege to standard users; use application control to block unapproved installer execution; restrict local logon and monitor for symbolic link abuse and file deletion in Razer installer directories; track vendor advisory and apply vendor-released patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpe
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). Rated critical seve
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Rated critical severity (CVSS 9.8), t
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by le
Synapse is an open source Matrix homeserver implementation. Rated high severity (CVSS 7.1), this vulnerability is remote
Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users t
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Rated medium severity (
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Rated high severity (CVSS 8.2)
Local privilege escalation in Razer Synapse 3 allows an attacker who already holds a low-privileged foothold on a Window
Local privilege escalation in Razer Synapse 3 lets an attacker who already has low-privileged code execution on a Window
GitHub PoC
Exploit-DB