CVE-2025-27727: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-27727 Overview

CVE-2025-27727 is a local privilege escalation vulnerability in Microsoft Windows Installer caused by improper link resolution before file access [CWE-59]. An authorized local attacker can abuse symbolic links or junctions processed by the installer service to redirect file operations executed under SYSTEM context. Successful exploitation grants the attacker SYSTEM-level privileges on the affected host.

The issue affects a broad range of client and server Windows versions, from Windows 10 1507 through Windows 11 24H2 and Windows Server 2008 through Windows Server 2025. Microsoft addressed the flaw in its April 2025 security update cycle.

Critical Impact
Local low-privileged users can escalate to SYSTEM on unpatched Windows endpoints and servers, enabling full host compromise, credential theft, and lateral movement.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-04-08 - CVE-2025-27727 published to NVD and Microsoft releases security patch
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27727

Vulnerability Analysis

CVE-2025-27727 is a link-following vulnerability [CWE-59] in the Windows Installer service (msiexec.exe / msiserver). The installer performs privileged file operations on paths that a low-privileged user can influence. When those paths traverse an attacker-controlled symbolic link, junction, or hard link, the installer follows the link and operates on the target as SYSTEM.

The vulnerability is exploitable locally by an authenticated user with low privileges and requires no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the host. Microsoft classifies the flaw as an Important-severity elevation of privilege issue and shipped a fix in the April 2025 Patch Tuesday release.

Root Cause

The root cause is missing validation of file system reparse points before privileged file operations. The Windows Installer service opens, writes, or deletes files in user-writable directories such as the per-user temp path or the %WINDIR%\Installer rollback location. An attacker who plants a junction or symlink in one of these directories can redirect the operation to an arbitrary target, causing the service to write, overwrite, or delete files it would not otherwise touch.

Attack Vector

Exploitation requires local, authenticated access. A typical attack chain triggers a repair, install, or uninstall action on an MSI package, then races the installer to swap a legitimate path for a symbolic link pointing to a protected file such as a DLL loaded by a SYSTEM service. When the installer writes attacker-controlled content through the link, the attacker gains code execution as SYSTEM. No user interaction is needed beyond the attacker's own actions on the compromised host. Public proof-of-concept code is not currently available.

Detection Methods for CVE-2025-27727

Indicators of Compromise

Creation of NTFS junctions or symbolic links inside %WINDIR%\Installer, %TEMP%, or per-user MSI cache directories by non-administrative users.
Unexpected msiexec.exe child processes or file writes to protected paths such as %WINDIR%\System32 originating from low-privileged user sessions.
Repeated MSI repair or reconfigure operations (event ID 1042, 1035) initiated by standard users in short succession.

Detection Strategies

Monitor for use of CreateSymbolicLink, mklink, or DeviceIoControl with FSCTL_SET_REPARSE_POINT from non-privileged processes targeting installer-owned directories.
Correlate file write events performed by msiexec.exe or TrustedInstaller.exe against paths that resolve through user-writable reparse points.
Alert on new or modified DLLs and executables in System32 immediately following an MSI transaction from a standard user account.

Monitoring Recommendations

Ingest Sysmon events (IDs 1, 11, and 15) and Windows security logs into a centralized SIEM to reconstruct installer-driven file activity.
Baseline normal MSI install patterns per host and flag deviations initiated by interactive, non-administrator users.
Track privileged process creations spawned shortly after MSI operations complete, focusing on unsigned or newly written binaries.

How to Mitigate CVE-2025-27727

Immediate Actions Required

Apply the April 2025 Microsoft security updates for all affected Windows client and server versions.
Prioritize patching multi-user systems, terminal servers, and jump hosts where low-privileged accounts have interactive access.
Audit local accounts and remove unnecessary interactive logon rights on servers to reduce the local-attacker surface.

Patch Information

Microsoft published a fix in the April 8, 2025 security update. Refer to the Microsoft Security Update Guide for CVE-2025-27727 for the specific KB articles for each supported Windows and Windows Server SKU. Install the appropriate cumulative or monthly rollup on every affected host.

Workarounds

No official workaround is provided by Microsoft; patching is the required remediation.
Restrict the ability of standard users to create symbolic links by keeping the SeCreateSymbolicLinkPrivilege limited to administrators (default on non-developer systems).
Disable or gate MSI repair functionality via Group Policy DisableMSI where installer usage by standard users is not required.

bash

# Verify SeCreateSymbolicLinkPrivilege assignment and disable per-user MSI installs
whoami /priv | findstr SeCreateSymbolicLinkPrivilege
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 1 /f