PT-2025-6338 · Microsoft · Windows Disk Cleanup Tool+1

Published 2025-02-11 · Updated 2026-02-11 · CVE-2025-21420

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Disk Cleanup Tool (affected versions not specified)

Description A critical issue exists within the Windows Disk Cleanup Tool (cleanmgr.exe) that allows for privilege escalation to SYSTEM privileges. The flaw involves errors in handling symbolic links and enables attackers to exploit the system through DLL sideloading. This issue, identified as CVE-2025-21420, has been actively exploited and a proof-of-concept (PoC) has been released. The exploitation of this issue could allow an attacker to gain elevated privileges on a compromised system. The vulnerability was addressed by Microsoft as part of the February 2025 Patch Tuesday.

Recommendations Apply the February 2025 security updates to address this vulnerability.

Exploit

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2025-01894

CVE-2025-21420

Affected Products

Windows

Windows Disk Cleanup Tool

References · 41

• 🔥 https://github.com/Network-Sec/CVE-2025-21420-PoC · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-21420 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21420 · Security Note
• https://bdu.fstec.ru/vul/2025-01894 · Security Note
• https://osv.dev/vulnerability/CVE-2025-21420 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1lcozdt/top_10_trending_cves_16062025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1lb55vv/top_10_trending_cves_14062025 · Reddit Post
• https://twitter.com/__Br1CkeD__/status/1891414843338473796 · Twitter Post
• https://twitter.com/transilienceai/status/1898342303317545453 · Twitter Post
• https://twitter.com/Brandefense/status/1892479241322651744 · Twitter Post
• https://twitter.com/syedaquib77/status/1892645610140139669 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1892573540571853255 · Twitter Post
• https://twitter.com/samilaiho/status/1892478803806470181 · Twitter Post