CVE-2025-48799

Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges locally.

Affected products

Windows, Windows 10, Windows 11, Windows Update Service

Microsoft Windows 10 1607

< 10.0.14393.8246

Microsoft Windows 10 1809

< 10.0.17763.7558

Microsoft Windows 10 21h2

< 10.0.19044.6093

Microsoft Windows 10 22h2

< 10.0.19045.6093

Microsoft Windows 11 22h2

< 10.0.22621.5624

Microsoft Windows 11 23h2

< 10.0.22631.5624

Fix

Available

CVSS 3.1

7.8 HIGH

EPSS

1.1% (61th percentile)

Weakness

CWE-59

NVD status

Analyzed

Published

2025-07-08