CVE-2025-64658CWE-362

CVE-2025-64658

High · published December 9, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

⚡ A race condition lurking in the Windows Shell could let an authorized attacker leap to higher privileges locally—like a VIP sneaking into the backstage area! 🎭 Think of it as two people trying to grab the same last cookie from a jar simultaneously. If one person is faster and manages to grab it before the other realizes what's happening, they get to enjoy the cookie while the other goes home empty-handed! This vulnerability is a goldmine for an attacker! If successfully exploited, they could elevate their privileges and gain access to sensitive resources, potentially leading to unauthorized system control and a cascade of devastating effects such as data theft or malicious changes to the system.

Put simply

Think of it as two people trying to grab the same last cookie from a jar simultaneously. If one person is faster and manages to grab it before the other realizes what's happening, they get to enjoy the cookie while the other goes home empty-handed! A race condition in the Windows Shell allows multiple processes to access shared resources without proper synchronization. This improper handling can enable an authorized user to escalate their privileges undetected.

What to do

This vulnerability is a goldmine for an attacker! If successfully exploited, they could elevate their privileges and gain access to sensitive resources, potentially leading to unauthorized system control and a cascade of devastating effects such as data theft or malicious changes to the system. To mitigate this issue, ensure that your systems are updated with the latest patches from Microsoft. Monitor your systems for any unusual privileges being granted, and consider implementing stricter access controls to reduce the risk of exploitation. You can tackle this! Keep your systems updated and follow the best practices, and you'll be well on your way to securing your environment! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2025-12-09T23:16Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows File Explorer Elevation of Privilege Vulnerability
    cvelistv5