CVE-2025-21292: Windows 10 1809 Privilege Escalation Flaw

CVE-2025-21292 Overview

CVE-2025-21292 is an elevation of privilege vulnerability in the Windows Search Service affecting supported releases of Windows 10, Windows 11, and Windows Server. Microsoft classifies the flaw under [CWE-94] (Improper Control of Generation of Code). A local, low-privileged attacker who successfully exploits the issue can elevate privileges, with scope change leading to compromise of resources beyond the vulnerable component. The vulnerability was published to the National Vulnerability Database on January 14, 2025.

Critical Impact
Successful exploitation allows a local attacker with low privileges to gain elevated rights on the host, with high impact to confidentiality, integrity, and availability across a changed scope.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86 and x64
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-01-14 - CVE-2025-21292 published to NVD
2025-01-14 - Microsoft released a security update addressing the vulnerability via Microsoft Security Update CVE-2025-21292
2025-01-24 - Last updated in NVD database

Technical Details for CVE-2025-21292

Vulnerability Analysis

The vulnerability resides in the Windows Search Service, the system component responsible for indexing files, email, and other content on Windows hosts. Microsoft categorizes the flaw under [CWE-94], indicating improper control over the generation of code executed by the service. The service runs with elevated privileges, so a flaw in how it processes attacker-controlled input enables a non-privileged local user to influence code paths that execute under a higher trust level.

The Common Vulnerability Scoring System (CVSS) vector indicates a scope change. A successful exploit therefore affects resources outside the security authority of the Search Service itself, including the operating system kernel context and other user sessions on the same machine.

Microsoft has not disclosed exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication. The Exploit Prediction Scoring System (EPSS) places this issue in the 67th percentile, reflecting a moderate likelihood of exploitation activity emerging.

Root Cause

The root cause is improper code generation control within the Search Service. The service generates or processes code or query constructs based on input that is not adequately validated, allowing a local attacker to influence the resulting execution path.

Attack Vector

The attack vector is local. An authenticated attacker with low privileges on the target system can trigger the vulnerable code path in the Windows Search Service. No user interaction is required. Because the Search Service runs with elevated rights, the attacker inherits those rights upon successful exploitation.

No public proof-of-concept exploit is currently available. Microsoft has not published technical exploitation details beyond the advisory. Refer to the Microsoft Security Update CVE-2025-21292 for vendor guidance.

Detection Methods for CVE-2025-21292

Indicators of Compromise

Unexpected child processes spawned by SearchIndexer.exe or SearchProtocolHost.exe, particularly command interpreters such as cmd.exe or powershell.exe.
New or modified files in %ProgramData%\Microsoft\Search\Data\ introduced by non-system accounts.
Token elevation or impersonation events where a low-privileged user session gains SYSTEM or administrator rights without a corresponding legitimate elevation chain.

Detection Strategies

Hunt for process lineage anomalies where the Search Service spawns scripting hosts, signed living-off-the-land binaries (LOLBins), or unsigned executables.
Correlate Windows Security Event ID 4672 (special privileges assigned) with process creation events tied to the Search Service.
Inspect Sysmon Event ID 1 and Event ID 10 (process access) for handle requests against SearchIndexer.exe from non-system processes.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block credential and process abuse from system services.
Forward Sysmon and Windows Security logs to a centralized analytics platform and apply behavioral analytics for privilege escalation patterns.
Track the patch status of all Windows endpoints and servers and flag hosts that have not received the January 2025 security rollup.

How to Mitigate CVE-2025-21292

Immediate Actions Required

Apply the January 2025 Microsoft security update referenced in the Microsoft Security Update CVE-2025-21292 advisory across all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize multi-user systems such as Remote Desktop Session Hosts and Citrix servers where local privilege escalation provides immediate lateral value.
Audit local accounts and remove unnecessary interactive logon rights to reduce the population of users who could trigger a local attack.

Patch Information

Microsoft released a security update for all affected versions through the January 2025 Patch Tuesday rollup. Administrators should deploy the cumulative update via Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or System Center Configuration Manager. Verify deployment using update history and the build numbers published in the Microsoft Security Update CVE-2025-21292 advisory.

Workarounds

Microsoft has not published a supported workaround. Patching is the recommended remediation.
As a temporary risk reduction measure, restrict interactive and Remote Desktop access on unpatched hosts to trusted administrators only.
Consider disabling the Windows Search Service (WSearch) on servers where indexing is not required, accepting the impact on search functionality until the patch is applied.

bash

# Verify Windows Search Service status and stop it on hosts where indexing is not required
sc.exe query WSearch
sc.exe config WSearch start= disabled
sc.exe stop WSearch