PT-2025-36478 · Microsoft · Windows

Jonnyjohnson · Published 2025-09-08 · Updated 2025-11-17 · CVE-2025-59033

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows versions (affected versions not specified)

Description: The Microsoft vulnerable driver block list, implemented as Windows Defender Application Control (WDAC) policy, does not properly block entries specifying the signing certificate’s TBS hash along with a 'FileAttribRef' qualifier on systems without hypervisor-protected code integrity (HVCI) enabled. This allows bypassing of intended security restrictions. The vendor recommends using App Control for systems without HVCI and a granular approach for custom blocklist entries.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-420

Related Identifiers

CVE-2025-59033

Affected Products

Windows

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-59033 · Security Note
• https://t.me/cveNotify/140924 · Telegram Post
• https://t.me/CVEtracker/31966 · Telegram Post
• https://t.me/cveNotify/139239 · Telegram Post
• https://t.me/cveNotify/143063 · Telegram Post
• https://t.me/cveNotify/142781 · Telegram Post
• https://twitter.com/0dayPublishing/status/1979259684461641779 · Twitter Post
• https://twitter.com/CVEnew/status/1965076113090138268 · Twitter Post
• https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity · Note
• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules · Note
• https://t.me/cveNotify/140921 · Telegram Post
• https://t.me/cveNotify/134670 · Telegram Post
• https://x.com/JonnyJohnson_/status/1895103112924307727 · Note