Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
For an attacker to exploit this vulnerability, they would need to have knowledge of a specific operation that triggers a memory allocation failure, specifically a use after free.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send the user a malicious file and convince the user to open it.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
This vulnerability could lead to a contained execution environment escape. Please refer to AppContainer Isolation for more information.
Security updates
10.0.17763.8146 — https://support.microsoft.com/help/5071544
10.0.20348.4529 — https://support.microsoft.com/help/5071547
10.0.20348.4467 — https://support.microsoft.com/help/5071413
10.0.19044.6691 — https://support.microsoft.com/help/5071546
10.0.26100.7462 — https://support.microsoft.com/help/5072033
10.0.26100.7392 — https://support.microsoft.com/help/5072014
10.0.22631.6345 — https://support.microsoft.com/help/5071417
10.0.25398.2025 — https://support.microsoft.com/help/5071542
Vulnerabilities 1
-
High 7.5
Windows File Explorer Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.
Revision history
-
#1
Information published.
References
-
CVE-2025-64658 Windows File Explorer Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64658
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss