CVE-2025-11772CWE-427

CVE-2025-11772

Medium · published December 2, 2025

CVSS v3.1
6.6
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

A carefully crafted DLL, copied to

C:\ProgramData\Synaptics

folder, allows a local user to execute

arbitrary code with elevated privileges during driver installation.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.7th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-12-02T00:15Z
References (1)
https://www.synaptics.com/sites/default/files/2025-12/fingerprint-driver-co-installer-security-brief-2025-12-01.pdf · [email protected]
EPSS history
Timeline
  • 01 DEC 18:55Z
    Co-Installer Privilege Escalation
    cvelistv5