CVE-2025-67781CWE-269privilege-escalation

CVE-2025-67781

Critical · published December 18, 2025

CVSS v3.1
9.9
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

🚨 A local unprivileged user can take control of privileged processes in DriveLock, turning security on its head! 🔥 Think of it like a construction worker finding a way to access the blueprints of a building, allowing them to make unauthorized changes to the structure. This flaw gives users the power to manipulate processes they normally wouldn’t have access to, effectively rewriting the rules of the game! An attacker with local access could seize control of critical processes, leading to unauthorized privilege escalation on Windows machines. This means they could gain access to sensitive data, install malicious software, or manipulate system configurations—essentially having free rein on the system.

Put simply

Think of it like a construction worker finding a way to access the blueprints of a building, allowing them to make unauthorized changes to the structure. This flaw gives users the power to manipulate processes they normally wouldn’t have access to, effectively rewriting the rules of the game! This vulnerability allows local users to exploit improperly secured privileged processes in DriveLock versions 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5, giving them elevated permissions on Windows systems.

What to do

An attacker with local access could seize control of critical processes, leading to unauthorized privilege escalation on Windows machines. This means they could gain access to sensitive data, install malicious software, or manipulate system configurations—essentially having free rein on the system. Immediately patch to DriveLock versions 24.1.6, 24.2.7, or 25.1.5 to close this loophole. Review user permissions and ensure that access control measures are strictly enforced to mitigate potential exploitation. You've got this! Follow these steps, and you'll be back in control in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00276 · 18.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-12-18T01:15Z
Affected products (3)
ProductVersionsFixed in
drivelock/drivelock≥ 24.1, < 24.1.624.1.6
drivelock/drivelock≥ 24.2, < 24.2.724.2.7
drivelock/drivelock≥ 25.1, < 25.1.525.1.5
References (1)
EPSS history
Timeline
  • 17 DEC 00:00Z
    An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5
    cvelistv5