CVE-2025-21322: Microsoft PC Manager Privilege Escalation

CVE-2025-21322 Overview

CVE-2025-21322 is an elevation of privilege vulnerability in Microsoft PC Manager, a system optimization and cleanup utility for Windows. The flaw is classified under [CWE-59] (Improper Link Resolution Before File Access, also known as a link-following vulnerability). A local, authenticated attacker with low privileges can abuse symbolic link handling in the application to gain higher privileges on the affected host. Microsoft published the advisory in the Security Update Guide and released a fixed version of PC Manager to address the issue.

Critical Impact
A successful exploit allows a low-privileged local user to elevate to SYSTEM-level privileges on hosts running vulnerable Microsoft PC Manager builds, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft PC Manager (all versions prior to the fixed build referenced in the Microsoft advisory)
Windows endpoints with Microsoft PC Manager installed
Environments where standard users can execute the PC Manager service or helper components

Discovery Timeline

2025-02-11 - CVE-2025-21322 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21322

Vulnerability Analysis

CVE-2025-21322 is a link-following vulnerability in Microsoft PC Manager. The application performs privileged file operations without adequately validating whether target paths are symbolic links, junctions, or hard links controlled by a lower-privileged user. An attacker running under a standard user account can plant a crafted link in a directory that PC Manager acts on, redirecting a privileged file operation to an attacker-chosen location.

Because PC Manager runs cleanup, cache, and optimization routines with elevated rights, redirected file writes, deletions, or overwrites can be leveraged to tamper with system files or drop attacker-controlled content into protected paths. This class of flaw is commonly used to convert an arbitrary file write or delete primitive into full local privilege escalation.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. PC Manager does not check that files and directories it operates on are not reparse points before opening them for privileged operations. Windows follows the link during the open call, so the elevated process ends up interacting with the target the attacker chose rather than the intended path.

Attack Vector

Exploitation requires local access and a valid low-privileged account on the target system. The attacker does not need user interaction beyond triggering or waiting for a PC Manager operation that touches the poisoned directory. The vulnerability manifests through symbolic link and junction abuse against directories used by the PC Manager service, so no network access or remote exploitation path is exposed. Refer to the Microsoft Security Update CVE-2025-21322 advisory for detailed technical guidance.

Detection Methods for CVE-2025-21322

Indicators of Compromise

Creation of symbolic links, junctions, or hard links inside directories used by the PC Manager service (for example, cache and temp locations under the PC Manager install path or %ProgramData%).
Unexpected file writes, replacements, or deletions in protected paths such as System32, Program Files, or driver directories originating from PC Manager processes.
New or modified privileged binaries, DLLs, or scheduled tasks appearing shortly after PC Manager cleanup or optimization runs.
Standard user processes creating reparse points immediately before a PC Manager scan or maintenance task executes.

Detection Strategies

Monitor process lineage where PC Manager binaries spawn child processes running as SYSTEM and then touch user-writable directories.
Alert on Windows event ID 4663 (object access) for PC Manager service accessing files whose full path resolves outside its expected working directories.
Track use of APIs and commands that create reparse points (CreateSymbolicLinkW, mklink, DeviceIoControl with FSCTL_SET_REPARSE_POINT) by non-administrative users.

Monitoring Recommendations

Enable file system auditing on PC Manager working directories and correlate access with the invoking process identity.
Ingest endpoint telemetry into a centralized SIEM or data lake to baseline normal PC Manager behavior and surface deviations.
Review installed versions of Microsoft PC Manager across the fleet on a recurring basis and flag hosts running builds older than the fixed release.

How to Mitigate CVE-2025-21322

Immediate Actions Required

Update Microsoft PC Manager to the fixed version referenced in the Microsoft Security Update CVE-2025-21322 advisory.
Inventory endpoints for Microsoft PC Manager installations, prioritizing multi-user systems and shared workstations for patching.
Restrict local logon and interactive access on hosts where PC Manager is installed until the patch is deployed.

Patch Information

Microsoft has issued a security update for PC Manager. Administrators should install the vendor-supplied update from the Microsoft Security Update CVE-2025-21322 advisory. Ensure PC Manager auto-update is enabled or push the fixed version through software distribution tooling.

Workarounds

Uninstall Microsoft PC Manager on systems where it is not required, particularly on servers and shared endpoints.
Enforce least privilege so that unnecessary local user accounts cannot create reparse points in directories consumed by PC Manager.
Apply application control policies to block execution of vulnerable PC Manager versions until the update is applied.

bash

# Check installed Microsoft PC Manager version on a Windows host
Get-AppxPackage -Name "*PCManager*" | Select-Object Name, Version, PackageFullName

# Uninstall Microsoft PC Manager as a temporary mitigation
Get-AppxPackage -Name "*PCManager*" | Remove-AppxPackage