CVE-2025-63945
Published: 23 February 2026
Summary
CVE-2025-63945 is a high-severity Link Following (CWE-59) vulnerability in Tencent Ioa. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-39 (Process Isolation).
Deeper analysis
CVE-2025-63945 is a privilege escalation vulnerability in the Tencent iOA application through version 210.9.28693.621001 on Windows devices. Published on 2026-02-23, it is classified under CWE-59 (Improper Link Resolution Before File Access) and carries a CVSS v3.1 base score of 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw enables a local user to execute arbitrary programs with elevated privileges, but successful exploitation hinges on reliably triggering an underlying race condition.
A local attacker requires physical or logical access to the target Windows system but no prior privileges (PR:N). Exploitation demands high complexity (AC:H) due to the race condition, with no user interaction needed (UI:N). If successful, the attacker can execute code at elevated privilege levels, resulting in high impacts to confidentiality, integrity, and availability.
Proof-of-concept exploit code is publicly available in GitHub repositories at https://github.com/alexlee820/CVE-2025-63945-Tencent-iOA-EoP and https://github.com/alexlee820/Tencent-iOA-EoP. No official advisories or patches are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207630
Vulnerability details
A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via exploitation of a race condition (CWE-59) in a Windows application directly enables T1068.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces access decisions on file operations so a local attacker cannot exploit improper link resolution to obtain elevated privileges.
Isolates processes so concurrent file-access operations cannot be reliably raced to achieve privilege escalation.
Verifies integrity of executable files and links before they are used, blocking or alerting on the malicious link substitution required by the race condition.