CVE-2025-21287
Published: 14 January 2025
Summary
CVE-2025-21287 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-11 (User-installed Software).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates CVE-2025-21287 by applying Microsoft patches to fix the Windows Installer elevation of privilege vulnerability.
Restricting user-installed software prevents low-privileged local attackers from exploiting Windows Installer to escalate privileges.
Enforcing least privilege addresses the improper privilege management (CWE-269) root cause of this Windows Installer elevation of privilege vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local EoP vulnerability in Windows Installer (CWE-269) directly enables exploitation for privilege escalation to gain high impacts on C/I/A.
NVD Description
Windows Installer Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21287 is a Windows Installer Elevation of Privilege Vulnerability affecting Microsoft Windows systems. Published on January 14, 2025, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management) along with NVD-CWE-noinfo.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, enabling privilege escalation on the affected system.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21287 provides guidance on mitigation and patching for this vulnerability.
Details
- CWE(s)