CVE-2025-29975 Overview
CVE-2025-29975 is a local privilege escalation vulnerability in Microsoft PC Manager. The flaw stems from improper link resolution before file access, classified as [CWE-59]. An authenticated attacker with low privileges can abuse symbolic or hard links to redirect file operations performed by the privileged PC Manager process. Successful exploitation grants the attacker elevated privileges on the local system.
Critical Impact
An authorized local attacker can elevate privileges to gain full confidentiality, integrity, and availability impact on the affected host.
Affected Products
- Microsoft PC Manager
Discovery Timeline
- 2025-05-13 - CVE-2025-29975 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29975
Vulnerability Analysis
Microsoft PC Manager performs privileged file operations without adequately validating whether target paths resolve through symbolic links, junctions, or hard links. A local attacker with standard user rights can plant a link in a directory the privileged service accesses. When PC Manager follows the link, it operates on an attacker-chosen target under SYSTEM context.
This link-following pattern is a well-documented Windows privilege escalation technique. Attackers typically use it to overwrite protected files, modify DACLs, or place malicious binaries into privileged locations. Exploitation requires prior local access and low-privileged authentication, but no user interaction is needed.
Root Cause
The root cause is improper link resolution before file access [CWE-59]. PC Manager opens or writes to file paths without applying flags such as FILE_FLAG_OPEN_REPARSE_POINT or verifying that the final resolved path matches the intended target. This allows a low-privileged user to substitute a link that redirects the operation.
Attack Vector
The attack vector is local. The attacker must already have code execution as a low-privileged user on the target system. The attacker creates a symbolic link, junction, or hard link in a location touched by the privileged PC Manager process. When PC Manager performs its file operation, it follows the link and acts on a sensitive system file. The result is arbitrary file write, delete, or overwrite as SYSTEM, which the attacker converts into full privilege escalation.
No public proof-of-concept exploit is currently available, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide CVE-2025-29975 for vendor technical details.
Detection Methods for CVE-2025-29975
Indicators of Compromise
- Creation of symbolic links, junctions, or hard links by non-administrative users in directories accessed by MSPCManager.exe or its service components.
- Unexpected file writes or overwrites to protected system paths performed by the PC Manager process context.
- New or modified binaries in privileged directories immediately following PC Manager scan, cleanup, or update operations.
Detection Strategies
- Monitor process activity from MSPCManager.exe for file operations that traverse reparse points or resolve to paths outside expected working directories.
- Alert on standard users invoking mklink, CreateSymbolicLink, or NTFS junction APIs targeting directories used by privileged services.
- Correlate low-privileged process activity with subsequent SYSTEM-level file modifications occurring within short time windows.
Monitoring Recommendations
- Enable Windows object access auditing on directories that PC Manager reads or writes to, and forward events to a centralized log platform.
- Track Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash) for reparse point creations by non-administrative users.
- Review installed PC Manager versions across the fleet and flag hosts still running vulnerable builds.
How to Mitigate CVE-2025-29975
Immediate Actions Required
- Update Microsoft PC Manager to the latest version referenced in the Microsoft Security Update Guide CVE-2025-29975.
- Restrict local logon rights and remove unnecessary interactive user accounts from systems running PC Manager.
- Audit endpoints for existing suspicious reparse points in directories used by PC Manager before patching.
Patch Information
Microsoft has published guidance and updated builds through the Microsoft Security Update Guide. Administrators should apply the vendor-supplied update for Microsoft PC Manager on all affected endpoints. Consult the Microsoft Security Update Guide CVE-2025-29975 for the fixed version and deployment instructions.
Workarounds
- Uninstall Microsoft PC Manager on systems where it is not required until the patched version is deployed.
- Enforce least-privilege policies so untrusted users cannot obtain local logon access to systems running PC Manager.
- Apply Attack Surface Reduction rules and application control policies to limit unauthorized process execution on affected hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
