CVE-2025-38738: Dell SupportAssist Privilege Escalation

CVE-2025-38738 Overview

CVE-2025-38738 is a local privilege escalation vulnerability in the Dell SupportAssist for Home PCs Installer. The flaw stems from an Incorrect Privilege Assignment weakness [CWE-266] in the installer executable. Affected builds include version 4.8.2.29006 and all prior releases. A low-privileged local user can exploit the flaw to elevate privileges on the target Windows host. Dell published fix guidance in advisory DSA-2025-296.

Critical Impact
A low-privileged local attacker can escalate to higher privileges through the SupportAssist Installer, gaining full confidentiality, integrity, and availability impact on the affected system.

Affected Products

Dell SupportAssist for Home PCs Installer 4.8.2.29006
Dell SupportAssist for Home PCs Installer versions prior to 4.8.2.29006
Related Dell SupportAssist for Business PCs builds referenced in DSA-2025-296

Discovery Timeline

2025-08-14 - CVE-2025-38738 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38738

Vulnerability Analysis

The vulnerability resides in the SupportAssist for Home PCs Installer executable. The installer assigns privileges incorrectly during execution, allowing operations performed under its context to run with elevated rights that should not be granted to the invoking user. The weakness is classified under [CWE-266] Incorrect Privilege Assignment, meaning a security-relevant subject is granted higher privileges than intended by the system's security model.

Exploitation requires local access and low privileges but no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability, consistent with a full privilege escalation to a SYSTEM-level or administrative context. This class of installer flaw is commonly abused post-compromise to persist, disable defenses, or move laterally on shared workstations.

Root Cause

The installer improperly assigns privileges to operations that a low-privileged user can influence. When the installer performs privileged actions such as writing to protected paths, loading libraries, or launching child processes, insufficient controls allow a local attacker to leverage those operations against unintended targets. The result is code or file operations executing with privileges beyond the caller's account.

Attack Vector

The attack vector is local. An authenticated user on the same system triggers the SupportAssist Installer flow, then abuses the incorrectly assigned privileges to run attacker-controlled code or modify protected resources. No network access, no user interaction from a second user, and no complex preconditions are required.

No verified proof-of-concept code is publicly available. See the Dell Security Update DSA-2025-296 advisory for vendor-provided technical details.

Detection Methods for CVE-2025-38738

Indicators of Compromise

Execution of the SupportAssist Installer executable by non-administrative users followed by unexpected privileged child processes.
Creation or modification of files in protected directories by processes spawned from the installer working directory.
Unexpected DLLs loaded from user-writable paths into the SupportAssist installer process.

Detection Strategies

Monitor process ancestry for cmd.exe, powershell.exe, or other interactive shells spawned as children of the SupportAssist Installer.
Alert on token elevation events where the parent is a SupportAssist Installer binary and the invoking user is non-privileged.
Track filesystem writes to C:\Program Files and C:\Windows originating from processes launched by low-privileged users through the installer.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging to capture installer invocations.
Baseline the SupportAssist Installer file hashes and versions across the fleet; flag executions of versions at or below 4.8.2.29006.
Correlate installer activity with subsequent privilege-sensitive events such as service installation, scheduled task creation, and local account changes.

How to Mitigate CVE-2025-38738

Immediate Actions Required

Inventory endpoints running Dell SupportAssist for Home PCs and identify installer versions at or below 4.8.2.29006.
Apply the fixed version referenced in Dell advisory DSA-2025-296 as soon as validated in your environment.
Restrict interactive local logon on shared or kiosk systems where SupportAssist is present until patching completes.

Patch Information

Dell has released fixed builds through advisory Dell Security Update DSA-2025-296. Update the SupportAssist for Home PCs Installer to the version specified in the advisory. Verify successful installation by confirming the installer executable version is above 4.8.2.29006.

Workarounds

Remove SupportAssist for Home PCs from systems that do not require Dell diagnostic functionality until the patch is deployed.
Enforce application control policies to block execution of vulnerable installer builds by non-administrative users.
Limit membership of local user groups on affected endpoints to reduce the pool of accounts able to trigger the installer.

bash

# Query installed SupportAssist version on Windows via PowerShell
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'Dell SupportAssist*' } |
  Select-Object Name, Version, Vendor