Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would gain the rights of the user that is running the affected application.
Security updates
10.0.17763.7558 — https://support.microsoft.com/help/5062557
10.0.20348.3932 — https://support.microsoft.com/help/5062572
10.0.19044.6093 — https://support.microsoft.com/help/5062554
10.0.22631.5624 — https://support.microsoft.com/help/5062552
10.0.26100.4652 — https://support.microsoft.com/help/5062553
10.0.25398.1732 — https://support.microsoft.com/help/5062570
10.0.10240.21073 — https://support.microsoft.com/help/5062561
10.0.14393.8246 — https://support.microsoft.com/help/5062560
Vulnerabilities 1
-
High 7.8
Windows StateRepository API Server file Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Revision history
-
#1
Information published. This CVE was addressed by updates that were released in July 2025, but the CVE was inadvertently omitted from the July 2025 Security Updates. This is an informational change only. Customers who have already installed the July 2025 updates do not need to take any further action.
References
-
CVE-2025-53789 Windows StateRepository API Server file Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53789
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss