Windows EUVD-2025-17770

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates significant real-world risk: local attack vector, low complexity, requires low privileges (standard user), no user interaction, impacts confidentiality, integrity, and availability. The S:U (Scope Unchanged) component limits domain escape but does not reduce severity of local privilege escalation. EPSS probability (if available) should be evaluated; exploitation likelihood is elevated because: (1) AC:L means no special conditions needed; (2) PR:L suggests any authenticated local user can trigger; (3) link-following bugs are well-understood attack patterns with existing research. KEV/CISA inclusion would indicate active exploitation. POC availability would elevate immediate risk. This is NOT a low-real-risk scenario—link-following vulnerabilities in privileged processes are reliably exploitable. Compare against SSVC: exploitation is likely probable/active (depends on KEV status), automatable (no user interaction), technical impact is total (privilege escalation to SYSTEM), making this a critical patch priority regardless of EPSS.

An authorized standard user on a Windows system crafts a malicious MSI package or intercepts a legitimate MSI installation. During MSI processing by msiexec.exe (executing with elevated privileges for system-wide install), the attacker exploits the link-following vulnerability by creating a symbolic link or NTFS junction in the installer's working directory (e.g., %TEMP% or installation staging location) that points to a sensitive system file or directory (e.g., C:\Windows\System32\config\SAM, a privileged registry hive, or a system executable). When Windows Installer's file operations follow the unvalidated link to read, write, or execute the target, the attacker gains the ability to: (a) read sensitive files (SAM dump leading to password cracking), (b) write to system locations (plant backdoors or modify critical binaries), or (c) execute arbitrary code in SYSTEM context (privilege escalation). AC:L means the attacker requires no special timing—the TOCTOU window is naturally present during MSI processing. No user interaction (UI:N) is required beyond the initial MSI invocation. POC would demonstrate link creation and exploitation steps; if one exists and is public, real-world risk is significantly elevated.