CVE-2025-27736: Windows 10 1607 Information Disclosure

CVE-2025-27736 Overview

CVE-2025-27736 is an information disclosure vulnerability in the Windows Power Dependency Coordinator component. This flaw allows an authorized attacker with local access to disclose sensitive information from affected Windows systems. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the system improperly exposes data that should be protected from unauthorized access.

Critical Impact
Local attackers with valid credentials can leverage this vulnerability to access sensitive system information, potentially enabling further attacks or data exfiltration from Windows endpoints and servers.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
Microsoft Windows Server 2016
Microsoft Windows Server 2019
Microsoft Windows Server 2022
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

April 8, 2025 - CVE-2025-27736 published to NVD
July 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-27736

Vulnerability Analysis

The Windows Power Dependency Coordinator is a system component responsible for managing power state dependencies between various Windows services and drivers. This vulnerability represents an information disclosure flaw where the component fails to properly restrict access to sensitive data, allowing local users with low privileges to read information they should not have access to.

The attack requires local access and low-level privileges, meaning an attacker must already have some form of authenticated access to the target system. However, no user interaction is required to exploit the vulnerability, making it potentially useful in post-compromise scenarios where attackers seek to gather additional intelligence about the target environment.

The confidentiality impact is rated as high, indicating that successful exploitation could result in significant disclosure of sensitive information. However, the vulnerability does not affect system integrity or availability—the attacker cannot modify data or disrupt system operations through this flaw alone.

Root Cause

The root cause stems from improper access controls within the Windows Power Dependency Coordinator component. The component exposes sensitive information to actors who should not have authorization to access it. This represents a failure in the principle of least privilege, where the component does not adequately verify that requesting processes have appropriate authorization levels before providing access to protected data.

Attack Vector

The attack is executed locally, requiring the attacker to have authenticated access to the target Windows system. The exploitation path involves:

The attacker establishes a local session on a vulnerable Windows system using valid credentials
The attacker interacts with the Windows Power Dependency Coordinator component
Due to insufficient access controls, the component discloses sensitive information
The attacker can use the disclosed information for reconnaissance or to facilitate further attacks

The vulnerability requires low privileges and no user interaction, making it relatively straightforward to exploit once local access is obtained. Organizations should consider this vulnerability as part of their defense-in-depth strategy, particularly in environments where insider threats or post-compromise lateral movement are concerns.

Detection Methods for CVE-2025-27736

Indicators of Compromise

Unusual access patterns to Windows Power Dependency Coordinator services or related system components
Unexpected queries or read operations targeting power management configuration data
Anomalous local user activity involving system service interactions from non-administrative accounts
Evidence of information gathering activities following initial system compromise

Detection Strategies

Monitor Windows Security Event Logs for unusual local access patterns and privilege usage
Implement endpoint detection rules to identify abnormal interactions with power management components
Deploy behavioral analytics to detect reconnaissance activities that may follow exploitation
Audit local user sessions for suspicious patterns of system component access

Monitoring Recommendations

Enable detailed Windows audit logging for system service access and object access events
Configure SentinelOne endpoint agents to monitor for suspicious local reconnaissance behaviors
Establish baselines for normal power management component interactions to identify anomalies
Correlate local access events with user behavior analytics to detect potential insider threats or compromised accounts

How to Mitigate CVE-2025-27736

Immediate Actions Required

Apply the latest Windows security updates from Microsoft as soon as possible
Review and restrict local access privileges to minimize the attack surface
Audit user accounts with local access to identify and remove unnecessary permissions
Implement network segmentation to limit lateral movement potential if systems are compromised

Patch Information

Microsoft has released security patches addressing CVE-2025-27736 for all affected Windows versions. Administrators should consult the Microsoft Security Response Center advisory for specific patch information and deployment guidance. Apply patches through Windows Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager according to your organization's patch management processes.

Workarounds

Restrict local logon rights to only users who require them for their job functions
Implement the principle of least privilege across all Windows systems
Monitor systems for signs of information disclosure or reconnaissance activities while awaiting patch deployment
Consider enhanced logging and monitoring on critical systems until patches can be applied

bash

# Review local access privileges on Windows systems
# Run in elevated PowerShell to audit local users and groups
Get-LocalGroupMember -Group "Users" | Format-Table Name, ObjectClass
Get-LocalGroupMember -Group "Remote Desktop Users" | Format-Table Name, ObjectClass

# Enable enhanced auditing for object access
auditpol /set /category:"Object Access" /success:enable /failure:enable