PT-2025-20646 · Unknown+1 · Winsta.Dll+1

Shellkraft · Published 2025-05-10 · Updated 2025-09-28 · CVE-2025-4525

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discord version 1.0.9188

Description A critical issue has been found in Discord, affecting some unknown functionality in the library WINSTA.dll. This issue leads to an uncontrolled search path. The attack must be approached locally and has a high complexity, making exploitation difficult. The exploit has been disclosed to the public.

Recommendations For Discord version 1.0.9188, consider restricting access to the WINSTA.dll library as a temporary mitigation measure until a patch is available.

Exploit

Fix

RCE

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

CVE-2025-4525

Affected Products

Discord

Winsta.Dll

References · 12

• 🔥 https://gist.github.com/shellkraft/ac4be6a3953e2889a7bf54aea2db88c2 · Exploit
• https://osv.dev/vulnerability/CVE-2025-4525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4525 · Security Note
• https://twitter.com/cracbot/status/1922970303640240522 · Twitter Post
• https://vuldb.com/?submit.562788 · Note
• https://twitter.com/CVEnew/status/1921337022964212147 · Twitter Post
• https://vuldb.com/?id.308270 · Note
• https://t.me/cvenotify/121658 · Telegram Post
• https://vuldb.com/?ctiid.308270 · Note
• https://twitter.com/grok/status/1948692549822284117 · Twitter Post
• https://t.me/cvedetector/25031 · Telegram Post
• https://t.me/cvetracker/23565 · Telegram Post