CVE-2025-21204

Deeper analysis

CVE-2025-21204 is an improper link resolution before file access vulnerability, also described as a link-following issue, that affects the Windows Update Stack. The flaw carries a CVSS 3.1 base score of 7.8 and is tracked under CWE-59; successful exploitation permits an attacker to perform unauthorized file operations that lead to privilege escalation on the local system.

An authorized local attacker with low privileges can exploit the weakness without user interaction. By supplying a crafted link that the update stack resolves incorrectly, the attacker can read, write, or modify protected files, resulting in full control over confidentiality, integrity, and availability on the affected host.

Microsoft’s Security Response Center advisory at msrc.microsoft.com provides official guidance, while independent resources from Vicarius supply PowerShell-based detection and mitigation scripts that practitioners can use to identify unpatched systems and apply workarounds until updates are installed.

EPSS for the CVE rose from lower values to a recorded peak of 0.0733 on 2026-02-03 before receding to the current 0.0481, indicating a measurable post-disclosure increase in exploitation interest that later subsided.