Windows EUVD-2025-17790

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates: (1) Local Attack Vector limits exposure to on-device attackers; (2) Low Attack Complexity means no special conditions needed; (3) Low Privileges required—standard user access suffices; (4) User Interaction required—victim must trigger Recovery Driver action, reducing autonomous exploitation; (5) High CIA impact across confidentiality, integrity, and availability. The score of 7.3 reflects moderate-to-high severity. Real-world risk assessment requires consideration of: KEV status (unknown from provided data, but if listed as actively exploited, priority increases significantly), EPSS probability (not provided but CWE-59 link-following vulnerabilities typically achieve 60-75% exploitation probability), and POC availability (not specified). The User Interaction requirement and local-only attack vector substantially reduce autonomous worm/ransomware risk compared to remote RCE vulnerabilities. However, in enterprise environments with shared workstations, local privilege escalation to SYSTEM is critical—enabling credential theft, lateral movement, and persistence. This is a HIGH-priority vulnerability for multi-user systems but lower urgency for single-user desktops with limited local attacker threat model.

A standard user ('user1') on a corporate Windows 10 workstation discovers that Windows Recovery needs attention due to a corrupted system file. When the user initiates recovery via Settings > System > Recovery > Reset this PC or similar recovery wizard, the Recovery Driver processes file repair operations. An attacker (either the same user or a malicious process running under that user context) pre-creates a symbolic link at a predictable path used by Recovery Driver—for example, C:\ProgramData\Recovery\temp\system32.lnk → C:\Windows\System32\config\SAM (the password hash database). When the Recovery Driver attempts to validate and copy files during recovery, it follows the symlink without proper verification and writes attacker-controlled data to the SAM database or reads sensitive system files. Alternatively, the attacker could link to a privileged driver or service configuration file, allowing code execution at SYSTEM level. Result: Attacker gains SYSTEM privileges, installs persistence mechanisms (scheduled task, registry run key, WMI event subscription), and maintains access for lateral movement or data exfiltration. The User Interaction requirement (victim must trigger recovery) slightly delays exploitation but is easily satisfied by social engineering or by waiting for routine maintenance windows. No POC availability data provided; however, given the straightforward nature of link-following attacks and public research on similar Windows vulnerabilities, a POC would likely emerge rapidly post-disclosure.