CVE-2025-21292
Published: 14 January 2025
Summary
CVE-2025-21292 is a high-severity Code Injection (CWE-94) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 26.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-21292 is a Windows Search Service Elevation of Privilege Vulnerability, published on 2025-01-14T18:15:50.927. It affects the Windows Search Service component in Microsoft Windows operating systems and is associated with CWE-94 (Code Injection) and NVD-CWE-noinfo. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to local attack vector, low complexity, low privileges required, no user interaction, changed scope, and high impacts across confidentiality, integrity, and availability.
A local attacker with low-level privileges can exploit this vulnerability through the Windows Search Service. Exploitation requires low complexity and no user interaction. Successful attacks enable privilege escalation, allowing the attacker to achieve high impacts on system confidentiality, integrity, and availability with a scope change.
Microsoft's advisory provides guidance on this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21292, where security practitioners can find details on patches and mitigation recommendations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2357
Vulnerability details
Windows Search Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local EoP vulnerability in Windows Search Service (CWE-94 code injection) directly enables privilege escalation from low to high privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the Windows Search Service EoP vulnerability by requiring timely application of Microsoft patches to remediate the code injection flaw.
Implements memory protections like DEP and ASLR to prevent successful code injection exploits in the Windows Search Service.
Enforces least privilege on the Windows Search Service to limit escalation impact even if the code injection vulnerability is exploited.