CVE-2025-59517CWE-284broken-access-control

CVE-2025-59517

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
2%
Percentile
84.3
In the wild
Unconfirmed
What it is

⚡ A crafty attacker could gain local admin privileges through a simple access control oversight! 🚨 Think of it like a hotel guest who finds an open door to the staff-only area — the unauthorized guest can now access all the behind-the-scenes operations, potentially wreaking havoc! 🏨 If exploited, this vulnerability could allow an attacker to elevate their privileges locally, giving them access to sensitive data, system configurations, and the ability to make harmful changes. This could lead to a complete security breach, exposing critical system functions and user data to unauthorized users!

Put simply

Think of it like a hotel guest who finds an open door to the staff-only area — the unauthorized guest can now access all the behind-the-scenes operations, potentially wreaking havoc! 🏨 The CVE-2025-59517 vulnerability stems from improper access control in the Windows Storage VSP Driver, permitting authorized users to escalate their privileges without proper restrictions in place.

What to do

If exploited, this vulnerability could allow an attacker to elevate their privileges locally, giving them access to sensitive data, system configurations, and the ability to make harmful changes. This could lead to a complete security breach, exposing critical system functions and user data to unauthorized users! To mitigate this vulnerability, ensure your systems are updated to the latest patches provided by Microsoft. Regularly audit user permissions and enforce least privilege access policies to limit potential exploitation. 🛡️ You can handle this! Stay proactive with updates and audits, and you'll keep your systems secure! 💪✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02452 · 84.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-09T23:15Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2016< 10.0.14393.868810.0.14393.8688
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Storage VSP Driver Elevation of Privilege Vulnerability
    cvelistv5