CVEvulnerability

CVE-2025-21391

7.1 HIGH Known exploited Published 2025-02-11 Modified 2026-09-24 Official page ↗

CISA Known Exploited Vulnerability

Microsoft Windows Storage Link Following Vulnerability — Microsoft Windows

Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.

Added to KEV
2025-02-11
Remediation due
2025-03-04
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21391
Status
Analyzed
Published
2025-02-11
Last modified
2026-09-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-59

Description

Windows Storage Elevation of Privilege Vulnerability

Affected configurations

• microsoft windows 10 1507 (< 10.0.10240.20915) • microsoft windows 10 1607 (< 10.0.14393.7785) • microsoft windows 10 1809 (< 10.0.17763.6893) • microsoft windows 10 21h2 (< 10.0.19044.5487) • microsoft windows 10 22h2 (< 10.0.19045.5487) • microsoft windows 11 22h2 (< 10.0.22621.4890) • microsoft windows 11 23h2 (< 10.0.22631.4890) • microsoft windows 11 24h2 (< 10.0.26100.3107) • microsoft windows server 2016 (< 10.0.14393.7785) • microsoft windows server 2019 (< 10.0.17763.6893) • microsoft windows server 2022 (< 10.0.20348.3148) • microsoft windows server 2022 23h2 (< 10.0.25398.1425) • microsoft windows server 2025 (< 10.0.26100.3107)

Related

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References