CVE-2025-43026: HP Support Assistant Privilege Escalation

CVE-2025-43026 Overview

CVE-2025-43026 is a local privilege escalation vulnerability in HP Support Assistant versions prior to 9.44.18.0. The flaw allows a local attacker to escalate privileges through an arbitrary file write primitive. The weakness is categorized as [CWE-281] (Improper Preservation of Permissions), indicating mishandled access control during file operations. HP published security advisory HPSBGN04022 detailing the affected versions and remediation steps. The vulnerability requires local access and user interaction, but successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
A local attacker can write arbitrary files to privileged locations, enabling escalation from a standard user to a higher-privileged context on Windows systems running vulnerable HP Support Assistant builds.

Affected Products

HP Support Assistant versions prior to 9.44.18.0
Windows endpoints with HP Support Assistant preinstalled by HP
HP consumer and commercial PCs shipped with the bundled support utility

Discovery Timeline

2025-06-05 - CVE-2025-43026 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43026

Vulnerability Analysis

HP Support Assistant is a preinstalled utility on HP PCs that performs diagnostics, driver updates, and warranty checks. The application runs components with elevated privileges to service these tasks. CVE-2025-43026 stems from improper preservation of permissions during file operations performed by the utility. A local user can leverage this behavior to write attacker-controlled content to locations the user could not normally modify. By targeting paths used by privileged processes, scheduled tasks, or services, the attacker can hijack execution flow and gain higher privileges. The vulnerability is local in scope and requires user interaction, narrowing remote exploitation but remaining a practical post-access escalation path in multi-user and enterprise environments.

Root Cause

The issue maps to [CWE-281] Improper Preservation of Permissions. The affected component does not retain restrictive access control list (ACL) semantics on files it creates or modifies. As a result, a privileged routine writes to a path influenced by an unprivileged caller, producing an arbitrary file write under elevated context.

Attack Vector

Exploitation requires local code execution as a standard user and a user-initiated action that triggers the vulnerable code path in HP Support Assistant. The attacker stages a controlled filename or symbolic reference, then induces the privileged component to write content to a sensitive location such as a system binary directory, scheduled task XML store, or service configuration path. Subsequent execution of the planted file under a privileged context completes the escalation.

No public proof-of-concept is currently available. See the HP Security Advisory HPSBGN04022 for vendor-supplied technical details.

Detection Methods for CVE-2025-43026

Indicators of Compromise

Unexpected file creation or modification in privileged directories by HPSupportAssistant.exe or related HP Support Assistant child processes
New or modified scheduled tasks, services, or DLLs in system paths shortly after HP Support Assistant execution by a non-administrative user
Anomalous writes to autorun locations, startup folders, or C:\ProgramData\HP\* directories from low-integrity processes

Detection Strategies

Monitor process lineage for HP Support Assistant components spawning from or writing on behalf of standard user sessions
Alert on file-write events where the writing process runs as SYSTEM but the originating user context is non-privileged
Inventory installed HP Support Assistant versions across the fleet and flag any build below 9.44.18.0

Monitoring Recommendations

Enable Windows audit policy for object access on HP Support Assistant install directories and %ProgramData%\HP
Forward endpoint telemetry covering process creation, file integrity, and privilege use to a central analytics platform
Correlate elevation events (token manipulation, service creation) with prior HP Support Assistant activity within a short time window

How to Mitigate CVE-2025-43026

Immediate Actions Required

Upgrade HP Support Assistant to version 9.44.18.0 or later on all affected endpoints
Audit endpoints for installed versions and prioritize systems where the utility is preinstalled by OEM image
Restrict local logon rights on shared workstations to reduce the exploitable attacker population

Patch Information

HP released a fixed build of HP Support Assistant in version 9.44.18.0. Refer to the HP Security Advisory HPSBGN04022 for download links, affected SKUs, and validation steps. Deploy the update through standard software management tooling and verify post-install version strings on representative endpoints.

Workarounds

Uninstall HP Support Assistant on systems where the utility is not required for business operations
Block execution of vulnerable HP Support Assistant binaries via application control policies until patching completes
Remove non-administrative users from local interactive logon on systems that retain the vulnerable version

bash

# Configuration example: query installed HP Support Assistant version on Windows endpoints
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*HP Support Assistant*" } | Select-Object Name, Version