CVE-2025-25008
Published: 11 March 2025
Summary
CVE-2025-25008 is a high-severity Link Following (CWE-59) vulnerability in Microsoft Windows Server 2016. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 45.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25008 is a vulnerability involving improper link resolution before file access, known as "link following," in Microsoft Windows. Published on 2025-03-11, it enables an authorized local attacker to elevate privileges and has a CVSS v3.1 base score of 7.1 (High), with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The issue maps to CWE-59: Improper Link Resolution Before File Access.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation allows the attacker to achieve high integrity (I:H) and availability (A:H) impacts, specifically enabling local privilege escalation on the affected Windows system.
Mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25008.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6344
Vulnerability details
Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local privilege escalation vulnerability in Windows due to improper link resolution (CWE-59), directly enabling exploitation to gain higher privileges on the system, which maps to T1068.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly prevents exploitation by identifying, reporting, and correcting the improper link resolution vulnerability through timely patching.
Reference monitor implementation mediates all subject-object access attempts, including proper link resolution, to enforce access controls and block privilege escalation.
Least privilege restricts the privileges of processes and users, limiting the setup of symlink attacks and the impact of any successful local escalation.