CVE-2025-48799

Deeper analysis

CVE-2025-48799 is a link-following vulnerability (CWE-59) in the Windows Update Service that stems from improper resolution of symbolic links before file access. The flaw affects the Windows Update Service component and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low complexity, and privileges required only at the authorized-user level.

An attacker who already possesses a local account on an affected Windows system can exploit the issue by supplying a crafted link that the service follows during update operations. Successful exploitation grants the attacker the ability to elevate privileges, resulting in full control over confidentiality, integrity, and availability on the host.

Microsoft’s security update guide for CVE-2025-48799 provides the authoritative source for patch availability and remediation steps. Third-party resources also publish detection and mitigation scripts that practitioners can use to identify unpatched systems and apply temporary controls until official updates are deployed. The associated EPSS scores remain low, with a current value of 0.0289 and a peak of 0.0307, indicating no material increase in observed exploitation interest after disclosure.