CVE-2025-43991: Dell SupportAssist Privilege Escalation

CVE-2025-43991 Overview

CVE-2025-43991 is a UNIX symbolic link (symlink) following vulnerability [CWE-61] affecting Dell SupportAssist for Home PCs and Dell SupportAssist for Business PCs. The flaw allows a low-privileged local attacker to delete arbitrary files on the affected system by abusing symlink resolution during privileged file operations. Dell disclosed the issue in security advisory DSA-2025-362 and released fixed builds for both product families.

Critical Impact
A local, low-privileged user can trigger deletion of arbitrary files, including protected operating system and application files, leading to integrity loss and denial of service on the affected endpoint.

Affected Products

Dell SupportAssist for Home PCs versions 4.8.2 and prior
Dell SupportAssist for Business PCs versions 4.5.3 and prior
Windows endpoints running the vulnerable SupportAssist agent

Discovery Timeline

2025-10-13 - CVE-2025-43991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43991

Vulnerability Analysis

Dell SupportAssist runs privileged components that perform file operations such as log rotation, cache cleanup, and temporary file removal. The affected code paths do not validate whether target paths are symbolic links before performing deletions. A local attacker with standard user privileges can plant a symlink inside a directory that SupportAssist processes, pointing to a sensitive file outside the intended scope.

When the privileged SupportAssist process traverses the crafted path, it follows the symlink and deletes the target file under the privileges of the service. This grants the attacker file deletion primitives beyond their own security context. The vulnerability is tracked as [CWE-61: UNIX Symbolic Link (Symlink) Following].

Exploitation does not yield direct code execution or information disclosure. However, deletion of arbitrary system files can destabilize the host, remove security controls, or be chained with other techniques to achieve privilege escalation.

Root Cause

The root cause is missing symlink validation in file cleanup routines executed by the SupportAssist service. The privileged process opens and unlinks files by path rather than by verified file handle, and it does not check reparse point or link attributes before operating on them.

Attack Vector

The attack requires local access and low privileges. The attacker stages a symbolic link in a directory that the SupportAssist service scans or cleans, waits for the privileged operation to occur, and observes the deletion of the linked target. No user interaction is required. See the Dell Security Update DSA-2025-362 advisory for vendor technical details.

// No verified public proof-of-concept is available for CVE-2025-43991.
// See vendor advisory DSA-2025-362 for technical details.

Detection Methods for CVE-2025-43991

Indicators of Compromise

Creation of symbolic links or NTFS junctions by non-administrative users inside directories used by SupportAssist for temporary files, logs, or caches.
Unexpected deletion of system, driver, or security agent files coinciding with SupportAssist service activity.
Repeated file-system reparse point creations from user-writable directories under %ProgramData%\Dell\SupportAssist or user profile paths.

Detection Strategies

Monitor process telemetry for mklink, CreateSymbolicLink, or DeviceIoControl with reparse point tags originating from unprivileged processes targeting Dell SupportAssist paths.
Correlate file deletion events performed by the SupportAssist service account against a baseline of expected cleanup targets.
Alert on SupportAssist service touching files outside its normal working directories, which indicates symlink redirection.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 11 (FileCreate) and 23 (FileDelete) for SupportAssist directories and forward logs to a central SIEM.
Audit filesystem reparse point creation using Windows security auditing on the affected endpoints.
Track SupportAssist agent version inventory to identify hosts still running versions 4.8.2 or 4.5.3 and earlier.

How to Mitigate CVE-2025-43991

Immediate Actions Required

Upgrade Dell SupportAssist for Home PCs to a version later than 4.8.2 as listed in DSA-2025-362.
Upgrade Dell SupportAssist for Business PCs to a version later than 4.5.3 as listed in DSA-2025-362.
Inventory all endpoints running SupportAssist and prioritize patching multi-user and shared systems.

Patch Information

Dell released fixed versions in Dell Security Update DSA-2025-362. Administrators should deploy the updated MSI packages through their standard software distribution channel and verify the installed version after upgrade.

Workarounds

Restrict interactive logon on managed endpoints to trusted users until patches are applied.
Remove or disable the SupportAssist service on systems that do not require Dell diagnostics until the update is deployed.
Enforce least privilege on directories used by SupportAssist to reduce the ability of standard users to create symbolic links.

bash

# Verify installed SupportAssist version on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Dell SupportAssist*' } |
  Select-Object DisplayName, DisplayVersion