PT-2025-31360 · Microsoft · Windows

Published 2025-07-29 · Updated 2026-01-30 · CVE-2025-25011

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025 (affected versions not specified)

Description An uncontrolled search path element vulnerability can lead to local privilege escalation (LPE) via insecure directory permissions. Improper handling of directory permissions allows a local attacker to move and delete arbitrary files, potentially gaining SYSTEM privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2025-09241

CLEANSTART-2026-OJ15484

CVE-2025-25011

Affected Products

Windows

References · 19

• https://bdu.fstec.ru/vul/2025-09241 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-OJ15484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25011 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47913 · Security Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OJ15484 · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OJ15484.json · Note
• https://osv.dev/vulnerability/CVE-2025-47913 · Note
• https://osv.dev/vulnerability/GHSA-j5w8-q4qc-rx2x · Note
• https://osv.dev/vulnerability/CVE-2025-25011 · Note
• https://osv.dev/vulnerability/GHSA-F6X5-JH6R-WRFV · Note
• https://t.me/CVEtracker/28722 · Telegram Post
• https://twitter.com/CVEnew/status/1950365029380801001 · Twitter Post
• https://twitter.com/rewterz/status/1950807808577843253 · Twitter Post
• https://osv.dev/vulnerability/GHSA-f6x5-jh6r-wrfv · Note
• https://twitter.com/CCBalert/status/1950564702347526558 · Twitter Post