CVE-2025-21391
Published: 11 February 2025
Summary
CVE-2025-21391 is a high-severity Link Following (CWE-59) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 10.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation of identified flaws, such as applying the Microsoft security update, directly eliminates the Windows Storage elevation of privilege vulnerability.
Vulnerability scanning identifies the presence of CVE-2025-21391 in Windows systems, enabling proactive patching before exploitation.
Enforcing least privilege restricts the actions of low-privileged local attackers, reducing the potential impact of successful privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local Windows Storage EoP vulnerability (CWE-59 link following) directly enables exploitation for privilege escalation from low-privileged local context.
NVD Description
Windows Storage Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21391 is a Windows Storage Elevation of Privilege Vulnerability affecting the Windows Storage component in Microsoft Windows operating systems. Published on 2025-02-11, it has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) and is associated with CWE-59.
The vulnerability can be exploited by a local attacker who already possesses low-level privileges on the target system. Exploitation requires low complexity and no user interaction, enabling the attacker to elevate privileges with high impacts on system integrity and availability, though confidentiality remains unaffected.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391 provides details on available security updates to address the issue. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21391, indicating real-world exploitation and requiring mitigation by federal civilian executive branch agencies.
Details
- CWE(s)
- KEV Date Added
- 11 February 2025