CVE-2025-24076
Published: 11 March 2025
Summary
CVE-2025-24076 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Windows 11 22H2. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 13.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations for access to system resources, countering the improper access control flaw in Windows Cross Device Service that enables local privilege escalation.
Applies least privilege principle to restrict low-privilege local attackers from gaining elevated access through the vulnerable service.
Mandates timely identification, reporting, and correction of the specific access control flaw, preventing exploitation via patching as recommended by MSRC.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local privilege escalation vulnerability via improper access control in a Windows service, directly mapping to exploitation for privilege escalation.
NVD Description
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2025-24076 is an improper access control vulnerability in the Windows Cross Device Service that allows an authorized attacker to elevate privileges locally. Published on 2025-03-11, it carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and maps to CWE-284: Improper Access Control.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) but requires user interaction (UI:R), such as tricking the user into performing a specific action. Successful exploitation enables privilege escalation without changing scope (S:U), resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
The Microsoft Security Response Center provides an update guide for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24076, which details patches and mitigation recommendations.
Details
- CWE(s)