PT-2025-42143 · Microsoft · Xbox Gaming Services

Published 2025-10-14 · Updated 2025-10-17 · CVE-2025-59281

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xbox Gaming Services (affected versions not specified)

Description An issue involving improper link resolution before file access, known as 'link following', exists in Xbox Gaming Services. This allows an authorized attacker to elevate privileges locally. The flaw enables local privilege escalation through symlink attacks and is considered trivial to weaponize.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-59281

Affected Products

Xbox Gaming Services

References · 6

• https://osv.dev/vulnerability/CVE-2025-59281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59281 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59281 · Vendor Advisory
• https://t.me/cveNotify/139185 · Telegram Post
• https://twitter.com/0dayPublishing/status/1978191388773589253 · Twitter Post
• https://twitter.com/CVEnew/status/1978198231310843973 · Twitter Post