CVE-2025-21206
Published: 11 February 2025
Summary
CVE-2025-21206 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Microsoft Visual Studio 2022. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 37.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the untrusted search path vulnerability in Visual Studio Installer by requiring timely application of vendor-provided patches.
Requires digital signatures and verification for software components, preventing the Visual Studio Installer from loading and executing malicious DLLs from untrusted search paths.
Deploys anti-malware mechanisms to scan for, prevent, and detect malicious code such as DLLs placed by local attackers in untrusted search paths exploited by this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-427 untrusted search path in VS Installer directly enables local DLL side-loading for privilege escalation (T1068).
NVD Description
Visual Studio Installer Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21206 is an Elevation of Privilege vulnerability in the Visual Studio Installer. Published on 2025-02-11T18:15:31.610, it carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and is linked to CWE-427 (Untrusted Search Path) as well as NVD-CWE-noinfo.
The vulnerability can be exploited by a local attacker possessing low privileges, requiring low attack complexity and user interaction. Successful exploitation enables privilege escalation, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft provides details on the vulnerability, including mitigation and patch information, in their Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21206.
Details
- CWE(s)