Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker would be able to delete any system files.
According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send the user a malicious file and convince the user to open it.
Security updates
10.0.17763.7792 — https://support.microsoft.com/help/5065428
10.0.20348.4171 — https://support.microsoft.com/help/5065432
10.0.20348.4106 — https://support.microsoft.com/help/5065306
10.0.19044.6332 — https://support.microsoft.com/help/5065429
10.0.22621.5909 — https://support.microsoft.com/help/5065431
10.0.26100.6584 — https://support.microsoft.com/help/5065426
10.0.26100.6508 — https://support.microsoft.com/help/5065474
10.0.25398.1849 — https://support.microsoft.com/help/5065425
10.0.10240.21128 — https://support.microsoft.com/help/5065430
10.0.14393.8422 — https://support.microsoft.com/help/5065427
Vulnerabilities 1
-
High 7.3
Windows MultiPoint Services Elevation of Privilege Vulnerability
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally.
Revision history
-
#1
Information published.
References
-
CVE-2025-54116 Windows MultiPoint Services Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54116
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss