CVE-2025-21235 Overview
CVE-2025-21235 is an elevation of privilege vulnerability in the Windows PrintWorkflowUserSvc service. The flaw allows an authenticated local attacker to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on January 14, 2025 as part of its monthly security update cycle. The vulnerability is classified under [CWE-20] Improper Input Validation and affects supported versions of Windows 10, Windows 11, and Windows Server.
Successful exploitation grants an attacker higher privileges on the local system, enabling further post-compromise activity such as credential theft or persistence.
Critical Impact
A low-privileged local user can elevate to higher privileges on the target host, resulting in full compromise of confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 10 21H2 and 22H2
- Microsoft Windows 11 22H2, 23H2, and 24H2
- Microsoft Windows Server 2022, Server 2022 23H2, and Server 2025
Discovery Timeline
- 2025-01-14 - CVE-2025-21235 published to NVD and addressed in Microsoft's January 2025 security updates
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21235
Vulnerability Analysis
The vulnerability resides in PrintWorkflowUserSvc, a Windows service that supports the modern print workflow used by Universal Print applications. The service processes print job data passed from user-mode applications. Improper validation of input handled by this service allows a local, authenticated attacker to influence execution in a way that yields higher-privileged operations.
Because the service runs with elevated rights compared to a standard user context, controlled inputs that bypass validation checks can be leveraged to perform privileged actions. Exploitation requires prior code execution on the host, such as through a standard user account, a phishing payload, or a chained vulnerability. No user interaction is needed once the attacker has local access.
Root Cause
The root cause is improper input validation [CWE-20] in the PrintWorkflowUserSvc component. The service does not sufficiently sanitize or verify data received from lower-privileged callers before acting on it, breaking the trust boundary between user-mode callers and the privileged service.
Attack Vector
The attack vector is local. An attacker authenticated with low privileges on the target Windows host interacts with the PrintWorkflowUserSvc service via its exposed interfaces. By supplying crafted input that abuses the validation flaw, the attacker triggers operations that execute in a higher-privileged context, achieving elevation of privilege.
No verified public proof-of-concept code is available for CVE-2025-21235 at the time of writing. Refer to the Microsoft Security Update CVE-2025-21235 advisory for vendor-provided technical details.
Detection Methods for CVE-2025-21235
Indicators of Compromise
- Unexpected child processes spawned by PrintWorkflowUserSvc.exe or related print workflow processes running under svchost.exe.
- New scheduled tasks, services, or account changes appearing shortly after activity involving the print workflow service.
- Standard user accounts performing actions that require SYSTEM or administrator privileges.
Detection Strategies
- Hunt for process lineage where PrintWorkflowUserSvc is a parent of shells such as cmd.exe, powershell.exe, or scripting hosts.
- Correlate token elevation events (Windows Security Event ID 4672) with the invoking user context to identify unexpected privilege assignments.
- Baseline normal print workflow activity per host and alert on statistical deviations in service call frequency or arguments.
Monitoring Recommendations
- Enable Sysmon process creation and image load logging on Windows 10, 11, and Server systems to capture activity around PrintWorkflowUserSvc.
- Forward Windows Security, System, and PrintService operational logs to a centralized SIEM for correlation.
- Monitor endpoints that permit standard user logins, such as workstations and Remote Desktop hosts, where local elevation attacks are most likely.
How to Mitigate CVE-2025-21235
Immediate Actions Required
- Apply the January 2025 Microsoft security updates addressing CVE-2025-21235 across all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching multi-user systems, jump hosts, and Remote Desktop Session Hosts where local elevation risk is highest.
- Audit local accounts and remove unnecessary interactive logon rights to reduce the pool of potential local attackers.
Patch Information
Microsoft released fixes for CVE-2025-21235 in the January 14, 2025 security updates. Consult the Microsoft Security Update CVE-2025-21235 advisory for the specific KB articles applicable to each Windows version and build.
Workarounds
- If patching cannot be performed immediately, disable the PrintWorkflowUserSvc service on systems that do not require modern print workflow functionality, after validating operational impact.
- Restrict local logon rights and enforce least privilege so that only trusted users can execute code on affected hosts.
- Apply application control policies such as Windows Defender Application Control or AppLocker to block untrusted binaries used to stage local exploits.
# Configuration example: query and disable PrintWorkflowUserSvc where not required
sc.exe query PrintWorkflowUserSvc
sc.exe config PrintWorkflowUserSvc start= disabled
sc.exe stop PrintWorkflowUserSvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
