CVE-2025-36564 Overview
CVE-2025-36564 affects Dell Encryption Admin Utilities versions prior to 11.10.2. The flaw is an improper link resolution weakness [CWE-59, CWE-61] that a local authenticated user can abuse to escalate privileges on the host. Dell published advisory DSA-2025-224 describing the issue and delivering fixed builds.
The vulnerability requires local access and low privileges, but no user interaction, and results in full compromise of confidentiality, integrity, and availability on the affected system. Dell Encryption is deployed on managed endpoints to enforce data-at-rest protection, so a successful exploit undermines a control that many organizations rely on for regulatory compliance.
Critical Impact
A local attacker with standard user rights can leverage symbolic link handling in Dell Encryption Admin Utilities to gain SYSTEM-level privileges on Windows endpoints.
Affected Products
- Dell Encryption Admin Utilities versions prior to 11.10.2
- Dell Encryption endpoint installations that include the Admin Utilities component
- Windows hosts running the vulnerable Dell Encryption client stack
Discovery Timeline
- 2025-06-03 - CVE-2025-36564 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36564
Vulnerability Analysis
Dell Encryption Admin Utilities perform privileged file operations on paths that a low-privileged local user can influence. The utility resolves those paths without validating whether any component is a symbolic link, junction, or hard link before acting on the target. This class of weakness is tracked as UNIX Symbolic Link (Symlink) Following [CWE-61] and Improper Link Resolution Before File Access [CWE-59].
Because the vulnerable code runs in a privileged context, an attacker who controls a directory used by the utility can redirect a write, delete, or attribute change to an arbitrary location. Typical outcomes include overwriting a SYSTEM-owned binary, planting a DLL loaded by a service, or corrupting a security-relevant configuration file. Any of these paths yield code execution as SYSTEM.
Root Cause
The root cause is a Time-of-Check to Time-of-Use (TOCTOU) style trust in filesystem paths handled by the Admin Utilities. The privileged process does not canonicalize the target, does not open handles with flags that reject reparse points, and does not verify ownership of intermediate directories before writing.
Attack Vector
Exploitation requires local code execution as a standard user on a host with vulnerable Dell Encryption Admin Utilities installed. The attacker seeds a working directory or temporary path with a symbolic link or junction pointing at a SYSTEM-writable target, then triggers the privileged utility operation. When the utility follows the link, the file operation is performed with elevated rights on the attacker-chosen target, producing local privilege escalation. Dell describes the outcome in advisory DSA-2025-224.
Detection Methods for CVE-2025-36564
Indicators of Compromise
- Creation of symbolic links, junctions, or hard links inside directories used by Dell Encryption Admin Utilities by non-administrative users.
- Unexpected writes to SYSTEM-owned files or Program Files paths originating from a Dell Encryption utility process.
- New or modified DLLs adjacent to Dell Encryption binaries with recent timestamps that do not match a vendor update.
Detection Strategies
- Hunt for process chains where a standard user process spawns or interacts with Dell Encryption Admin Utilities immediately before a privileged file modification.
- Alert on CreateSymbolicLink, mklink, or DeviceIoControl reparse-point operations targeting Dell installation or temp directories.
- Correlate Dell Encryption service events with subsequent SYSTEM-context file writes outside the product's normal working set.
Monitoring Recommendations
- Enable filesystem auditing on the Dell Encryption program directory and any temp paths used by the Admin Utilities.
- Forward endpoint telemetry (process, file, and link creation events) to a central data lake for correlation across the fleet.
- Track installed Dell Encryption versions through software inventory and alert when hosts drop below 11.10.2.
How to Mitigate CVE-2025-36564
Immediate Actions Required
- Inventory all endpoints running Dell Encryption and identify installations below version 11.10.2.
- Apply the update referenced in Dell advisory DSA-2025-224 as soon as change control permits.
- Restrict local logon and interactive access on hosts running Dell Encryption Admin Utilities to trusted administrators until patched.
- Review recent local privilege escalation alerts on Dell-managed endpoints for signs of prior exploitation.
Patch Information
Dell has released Dell Encryption Admin Utilities version 11.10.2, which corrects the improper link resolution behavior. Full remediation details, download locations, and affected SKUs are documented in Dell Security Advisory DSA-2025-224.
Workarounds
- Limit membership of local user groups on systems where Dell Encryption Admin Utilities are installed to reduce the pool of potential attackers.
- Enforce application control policies that block untrusted binaries from executing in user-writable directories.
- Monitor for symbolic link and reparse-point creation by non-privileged users and treat such activity on managed endpoints as high fidelity.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
