CVE-2025-29795: Microsoft Edge Privilege Escalation Flaw

CVE-2025-29795 Overview

CVE-2025-29795 is a local privilege escalation vulnerability in Microsoft Edge Update, the component responsible for maintaining the Chromium-based Edge browser. The flaw stems from improper link resolution before file access, commonly referred to as link following [CWE-59]. An authorized local attacker can exploit the weakness to elevate privileges on the affected system. Microsoft disclosed the issue through its Security Update Guide, and the vulnerability carries a CVSS 3.1 base score of 7.8. No public proof-of-concept code has been published, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local, authenticated attacker can abuse symbolic or hard links processed by Microsoft Edge Update to gain higher-privileged access, compromising confidentiality, integrity, and availability on the host.

Affected Products

Microsoft Edge Update (Chromium-based)
Windows systems running the Edge Update service
All Microsoft Edge installations relying on the vulnerable update component

Discovery Timeline

2025-03-23 - CVE-2025-29795 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-29795

Vulnerability Analysis

The vulnerability resides in how Microsoft Edge Update resolves file paths before accessing them. The update component performs privileged file operations without adequately validating whether the target path is a symbolic link, junction, or hard link. When a lower-privileged user plants a crafted link inside a directory that the update service later reads or writes, the service follows the link and operates on a file the attacker could not otherwise touch. This mismatch between the security context of the caller and the target file produces a classic link-following privilege escalation.

Exploitation requires local access and low-privileged authenticated user context. No user interaction is needed once the attacker has planted the malicious link and triggered the vulnerable operation. Successful exploitation gives the attacker the ability to write, replace, or read files with the elevated privileges of the update service, which typically runs with SYSTEM-level rights on Windows.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. Microsoft Edge Update does not verify that intermediate or final path components are regular files owned by a trusted principal. Instead, it opens or manipulates files by path, allowing filesystem redirection through NTFS features such as symbolic links, mount points, and object manager symlinks.

Attack Vector

The attack vector is local. A local user places a link inside a directory Microsoft Edge Update touches during install, update, or maintenance operations. When the elevated Edge Update service performs a file operation against that path, it follows the link to an attacker-chosen location. The attacker then leverages the resulting file write or deletion to plant a payload in a privileged location, replace a service binary, or otherwise convert the arbitrary file operation into code execution as SYSTEM. Technical details are documented in the Microsoft Security Update Guide for CVE-2025-29795.

Detection Methods for CVE-2025-29795

Indicators of Compromise

Unexpected NTFS symbolic links, junctions, or hard links inside directories used by Microsoft Edge Update, typically under C:\ProgramData\Microsoft\EdgeUpdate\ or C:\Program Files (x86)\Microsoft\EdgeUpdate\.
New or modified files in privileged locations correlated with MicrosoftEdgeUpdate.exe activity from a non-administrative user session.
Unexpected service binary replacements or scheduled task modifications associated with the Edge Update service.

Detection Strategies

Monitor process creation events for MicrosoftEdgeUpdate.exe running with SYSTEM privileges immediately after file or link creation by a standard user process.
Alert on use of the CreateSymbolicLink API or mklink command by non-administrative accounts targeting Edge Update directories.
Correlate file write events in privileged paths with the security context of the initiating process to detect confused-deputy behavior.

Monitoring Recommendations

Enable Windows object access auditing on Edge Update directories to capture handle open events with impersonation context.
Ingest Sysmon Event IDs 1, 11, and 15 into a centralized SIEM to reconstruct link-planting sequences.
Track the installed version of Microsoft Edge Update across the fleet and flag hosts running builds released before the March 2025 patch cycle.

How to Mitigate CVE-2025-29795

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-29795 to all Windows endpoints running Microsoft Edge.
Verify that Microsoft Edge Update has upgraded to the patched build by checking the version of MicrosoftEdgeUpdate.exe on representative hosts.
Audit Edge Update directories for pre-existing symbolic links or junctions and remove any that do not belong.

Patch Information

Microsoft addressed CVE-2025-29795 through an updated release of Microsoft Edge Update distributed via the standard Edge automatic update channel. Administrators should confirm that automatic updates are enabled and reaching endpoints. Air-gapped or update-restricted systems require manual deployment of the fixed installer obtained from Microsoft.

Workarounds

Restrict the ability of non-administrative users to create symbolic links by tightening the SeCreateSymbolicLinkPrivilege assignment through Group Policy.
Apply strict NTFS permissions on Edge Update working directories to prevent standard users from writing link objects.
Where patching is temporarily infeasible, disable the Microsoft Edge Update service until the security update can be applied, accepting that the browser will no longer receive automatic updates.

bash

# Group Policy setting to restrict symbolic link creation to Administrators only
# Computer Configuration > Windows Settings > Security Settings > Local Policies
#   > User Rights Assignment > Create symbolic links
# Assigned Principals: Administrators