PT-2025-28533 · Microsoft · Windows Update Service+3

Filip Dragović + 1 · Published 2024-09-03 · Updated 2025-12-03 · CVE-2025-48799

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to July 8, 2025

Description An improper link resolution vulnerability exists in the Windows Update Service before file access. This allows an authorized attacker to elevate privileges locally. The vulnerability affects Windows 10 and Windows 11 clients with at least two hard drives. The wuauserv service is involved, and the vulnerability relates to incorrect handling of symbolic links during file access, potentially enabling arbitrary file deletion and privilege escalation.

Recommendations Update your systems to the latest version available before July 8, 2025, to address this vulnerability.

Exploit

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2025-08180

BDU:2025-13735

CVE-2025-48799

Affected Products

Windows

Windows 10

Windows 11

Windows Update Service

References · 45

• 🔥 https://github.com/Wh04m1001/CVE-2025-48799?tab=readme-ov-file · Exploit
• 🔥 https://github.com/Wh04m1001/CVE-2025-48799 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-48799-detection-script-elevation-of-privilege-vulnerability-in-windows-update-service · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-48799-mitigation-script-elevation-of-privilege-vulnerability-in-windows-update-service · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48799 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08180 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48799 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-48799 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48799 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48799 · Security Note
• https://bdu.fstec.ru/vul/2025-13735 · Security Note
• https://t.me/breachdetector/807370 · Telegram Post
• https://twitter.com/omoroouma1/status/1943216430092292236 · Twitter Post
• https://t.me/hybgl/2120 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1lvexd0/top_10_trending_cves_09072025 · Reddit Post