CVE-2025-33075: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-33075 Overview

CVE-2025-33075 is a local privilege escalation vulnerability in Windows Installer (msiexec.exe). Microsoft published the advisory on June 10, 2025. The flaw stems from improper link resolution before file access, classified under CWE-59. An authenticated local attacker can abuse symbolic links or junctions to redirect Windows Installer file operations to targets they do not otherwise control. Successful exploitation grants SYSTEM-level privileges.

The issue affects a broad range of Windows client and server releases, from legacy Windows Server 2008 through Windows 11 24H2 and Windows Server 2025.

Critical Impact
Any low-privileged local user can leverage msiexec.exe link-following behavior to overwrite or create files as SYSTEM, resulting in full host compromise.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-06-10 - CVE CVE-2025-33075 published to NVD
2025-06-10 - Microsoft releases security patch via Patch Tuesday advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-33075

Vulnerability Analysis

Windows Installer performs file operations under the NT AUTHORITY\SYSTEM context during install, repair, and rollback flows. The service creates, copies, and deletes files in locations such as C:\Windows\Installer, C:\Config.Msi, and per-user temp directories. When those paths contain attacker-controlled reparse points, the installer follows the link and operates on the target rather than the intended file.

Because the checks that validate the destination happen before the file is accessed, a local user can substitute the path between validation and use. This is a classic link-following weakness described by CWE-59 and is a recurring pattern in Windows Installer components.

Root Cause

The underlying defect is that msiexec.exe and related MSI service code do not properly resolve or reject filesystem links before acting on file paths. Directories writable by standard users can be transformed into NTFS junctions or object-manager symbolic links pointing at protected locations. Windows Installer then performs privileged writes, deletes, or attribute changes against those redirected targets.

Attack Vector

Exploitation requires local, authenticated access with low privileges and no user interaction. The typical technique involves triggering an MSI operation (install, repair using msiexec /fa, or uninstall of a targeted package), racing the installer to replace a working directory with a junction, and forcing the SYSTEM-privileged process to write to or delete a file the attacker could not otherwise touch. The result is arbitrary file write, arbitrary file delete, or DLL hijack primitives, each of which is routinely converted to SYSTEM code execution.

No public proof-of-concept exploit is listed for CVE-2025-33075, and it is not present in the CISA Known Exploited Vulnerabilities catalog as of publication. The EPSS probability is 0.527%.

Detection Methods for CVE-2025-33075

Indicators of Compromise

Unexpected reparse points (junctions or symbolic links) created by non-administrative users in C:\Windows\Installer, C:\Config.Msi, or %TEMP% directories.
msiexec.exe writing to or deleting files outside standard installer working directories, especially under C:\Windows\System32 or Program Files.
New or modified files in privileged paths whose owner is a standard user account.

Detection Strategies

Alert on msiexec.exe file operations targeting paths that were reached via a reparse point owned by a non-privileged user.
Correlate MSI repair or rollback events (MsiInstaller Event IDs 1035, 11707, 1042) with subsequent privileged file writes.
Hunt for standard-user processes creating junctions using CreateSymbolicLinkW or the DeviceIoControlFSCTL_SET_REPARSE_POINT code prior to installer activity.

Monitoring Recommendations

Enable Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) with rules covering installer directories.
Forward Windows Installer service and Application event logs to a central SIEM for correlation with process telemetry.
Track patch compliance for the June 2025 Windows security updates across all endpoints and servers.

How to Mitigate CVE-2025-33075

Immediate Actions Required

Apply the June 2025 Microsoft security updates that address CVE-2025-33075 on every affected Windows client and server SKU.
Prioritize multi-user systems, Remote Desktop Session Hosts, and jump boxes where local attackers are most likely to have footholds.
Audit installed MSI packages and remove third-party installers that expose predictable working directories to standard users.

Patch Information

Microsoft published the fix in the June 10, 2025 Patch Tuesday release. Refer to the Microsoft Security Update Guide for CVE-2025-33075 for the KB numbers matching each affected build. Installing the corresponding cumulative update or monthly rollup fully remediates the link-following behavior in Windows Installer.

Workarounds

No official workaround is provided by Microsoft; patching is the only supported remediation.
Restrict interactive logon on servers to trusted administrators to reduce local attack surface until patches are applied.
Where feasible, disable the AlwaysInstallElevated policy and block user-initiated MSI installations via AppLocker or Windows Defender Application Control.

bash

# Verify the June 2025 cumulative update is installed (PowerShell)
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2025-06-10') } | Sort-Object InstalledOn -Descending

# Disable AlwaysInstallElevated to reduce MSI abuse surface
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f