PT-2025-15482 · Microsoft · Windows Update Stack+1

Oruga · Published 2025-04-08 · Updated 2026-01-27 · CVE-2025-21204

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to February 2025 Patchday

Description A flaw exists in the Windows Update Stack related to improper link resolution before file access. Successful exploitation of this issue, identified as CVE-2025-21204, allows an attacker with low privileges to elevate their permissions and potentially gain SYSTEM-level access. The vulnerability stems from the Windows Update Stack incorrectly handling symbolic links on unpatched systems, enabling attackers to manipulate file access. A researcher discovered that even non-administrative users could exploit this issue to block Windows updates by creating a junction between C:inetpub and any system file. Microsoft created the C:inetpub folder as part of a security update to mitigate this vulnerability, and users are advised not to delete it. The creation of this folder has been observed even on systems without Internet Information Services (IIS) installed. A proof-of-concept exploit has been published.

Recommendations Do not delete the C:inetpub folder, regardless of whether IIS is enabled. If the C:inetpub folder was deleted, restore it by installing Internet Information Services from the Windows Features control panel. Monitor for the creation of junctions or changes to system files. Ensure systems are updated regularly.

Fix

DoS

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2025-04254

CVE-2025-21204

Affected Products

Windows

Windows Update Stack

References · 104

• https://nvd.nist.gov/vuln/detail/CVE-2025-21204 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21204 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21204 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-us/advisory/CVE-2025-21204 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04254 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21204 · Vendor Advisory
• https://twitter.com/ApkZillaDaily/status/1910788439584498105 · Twitter Post
• https://twitter.com/RealBigManBonk/status/1912418603900780961 · Twitter Post
• https://twitter.com/fernandokarl/status/1910709970317763044 · Twitter Post
• https://twitter.com/Jfreeg_/status/1910725102108389378 · Twitter Post
• https://twitter.com/Goosken/status/1910695001291440309 · Twitter Post
• https://twitter.com/freedomhack101/status/1914654807648035134 · Twitter Post
• https://twitter.com/syedaquib77/status/1912055229643964549 · Twitter Post
• https://t.me/true_secator/7114 · Telegram Post