CVE-2025-59516CWE-306CWE-73

CVE-2025-59516

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
2%
Percentile
83.5
In the wild
Unconfirmed
What it is

⚡ A missing authentication check in Windows Storage VSP Driver opens the door for authorized attackers to level up their access — think of it as a guest in a hotel suddenly getting keys to the executive suite! 🚪💼 Imagine you're at a restaurant where only the head chef has access to the secret ingredient stash, but due to a missing check, any staff member could stroll in and grab whatever they want. That’s what’s happening here — unauthorized users can gain elevated privileges without proper oversight. This vulnerability allows an attacker who already has access to the system to escalate their privileges and potentially take control over critical functions. If exploited, they could manipulate system settings, access sensitive data, or install malicious software, leading to a severe compromise of the system's integrity.

Put simply

Imagine you're at a restaurant where only the head chef has access to the secret ingredient stash, but due to a missing check, any staff member could stroll in and grab whatever they want. That’s what’s happening here — unauthorized users can gain elevated privileges without proper oversight. CVE-2025-59516 is a local privilege escalation vulnerability in the Windows Storage VSP Driver, which lacks necessary authentication checks for a critical function, allowing unauthorized access to elevated privileges for users who are already authenticated.

What to do

This vulnerability allows an attacker who already has access to the system to escalate their privileges and potentially take control over critical functions. If exploited, they could manipulate system settings, access sensitive data, or install malicious software, leading to a severe compromise of the system's integrity. To remediate this issue, patch to the latest version of the Windows Storage VSP Driver as soon as it becomes available. Additionally, implement strict monitoring of user permissions to detect any unauthorized privilege escalation attempts. You've got this! Stay vigilant, apply the patch, and keep your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02342 · 83.5th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-73 · External Control of File Name or Path
Published
2025-12-09T23:15Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Storage VSP Driver Elevation of Privilege Vulnerability
    cvelistv5