CVE-2025-24076

Published Mar 11, 2025

Last updated 3 months ago

Windows Cross Device Service

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24076 is a vulnerability in the Windows Cross Device Service related to improper access control. It allows an authorized attacker with local access to elevate their privileges on the system. The vulnerability can be exploited using a technique called DLL hijacking. A low-privileged user can modify a DLL file that is loaded by a COM server running with elevated privileges, potentially leading to the execution of arbitrary code with system-level permissions.

Description: Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.3
Impact score: 5.9
Exploitability score: 1.3
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-284

Hype score: Not currently trending

References