PT-2025-42030 · Microsoft · Windows

Published 2025-10-14 · Updated 2025-12-16 · CVE-2025-55680

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to October 2025 Description A time-of-check time-of-use (TOCTOU) race condition exists in the Windows Cloud Files Mini Filter Driver. This condition allows a locally authorized attacker to elevate privileges. The issue stems from incorrect handling of file access checks during placeholder creation requests, specifically within the HsmFltProcessHSMControl, HsmFltProcessCreatePlaceholders, and HsmpOpCreatePlaceholders function calls. The vulnerability bypasses a previous patch addressing a similar issue reported in 2020. Exploitation involves manipulating the file path string to circumvent access control checks, enabling arbitrary file creation and potential system compromise. The vulnerability was discovered in March 2024 and addressed in October 2025. Recommendations Update Windows to the latest version released in October 2025 or later.

Fix

LPE

Race Condition

Time Of Check To Time Of Use

Weakness Enumeration

CWE-362

CWE-367

Related Identifiers

BDU:2025-13273

CVE-2025-55680

Affected Products

Windows

References · 40

• https://nvd.nist.gov/vuln/detail/CVE-2025-55680 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-55680 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55680 · Security Note
• https://bdu.fstec.ru/vul/2025-13273 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55680 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55680 · Vendor Advisory
• https://twitter.com/Karma_X_Inc/status/1987675337879155048 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/1987108792081736070 · Twitter Post
• https://t.me/pentestingnews/70733 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1od45nf/top_10_trending_cves_22102025 · Reddit Post
• https://twitter.com/cplearns2h4ck/status/1978652258629038298 · Twitter Post
• https://twitter.com/CVEnew/status/1978171222233067671 · Twitter Post
• https://t.me/CSIRT_italia/2849 · Telegram Post
• https://twitter.com/hackyboiz/status/1992171198000886172 · Twitter Post
• https://t.me/defcon_news/132572 · Telegram Post