CVE-2025-4525: Discord Path Traversal Vulnerability

CVE-2025-4525 Overview

CVE-2025-4525 affects Discord version 1.0.9188 on Windows. The vulnerability resides in how the Discord client loads the WINSTA.dll library. The flaw is classified as an uncontrolled search path element [CWE-426], commonly referred to as DLL search order hijacking. A local attacker who can place a malicious WINSTA.dll in a directory searched before the legitimate system location can achieve code execution in the context of the Discord process. The exploit has been publicly disclosed. The vendor was contacted before public disclosure but did not respond, and no vendor patch is currently referenced in the advisory data.

Critical Impact
A local attacker with low privileges can hijack DLL loading in the Discord client to execute arbitrary code, compromising confidentiality, integrity, and availability of the user session.

Affected Products

Discord 1.0.9188 for Windows
Microsoft Windows (all supported versions running the affected Discord build)
Any endpoint where the vulnerable Discord client is installed alongside writable directories in the DLL search path

Discovery Timeline

2025-05-10 - CVE-2025-4525 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4525

Vulnerability Analysis

The Discord Windows client resolves the WINSTA.dll dependency using an uncontrolled search path. Windows applications typically search several directories, including the current working directory and other application-controlled paths, before falling back to System32. When an application does not explicitly qualify the path to a system DLL, the loader can be tricked into loading an attacker-supplied library. In this case, a malicious WINSTA.dll placed in a directory that appears earlier in the search order is loaded into the Discord process. Code inside DllMain executes immediately with the privileges of the user running Discord. Because the client runs in the interactive user context, exploitation delivers user-level code execution rather than a system-wide privilege escalation.

Root Cause

The root cause is improper resolution of the WINSTA.dll search path within the Discord client, matching the [CWE-426] Untrusted Search Path weakness. The client does not enforce a fully qualified path or apply Windows safe DLL search mode protections such as LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32.

Attack Vector

Exploitation is local and carries higher attack complexity. The attacker must have local access as a low-privileged user and the ability to write a crafted WINSTA.dll into a directory searched by the Discord loader before the legitimate system path. Common delivery scenarios include planting the payload in a writable application directory, a user download folder from which Discord is launched, or a shared network folder used as the working directory. When the victim starts Discord, the malicious DLL is loaded and its entry point executes attacker-controlled code.

No verified code sample is available. A proof-of-concept is referenced in the GitHub Gist PoC Code and further analysis is published in the VulDB CVE Analysis #308270.

Detection Methods for CVE-2025-4525

Indicators of Compromise

Presence of a WINSTA.dll file in any Discord installation directory, user profile folder, or working directory outside of C:\Windows\System32.
Discord process (Discord.exe, Update.exe) loading WINSTA.dll from a non-system path as recorded in image load telemetry.
Unexpected child processes or outbound network connections spawned from the Discord process shortly after startup.

Detection Strategies

Hunt endpoint telemetry for module load events where the image name is WINSTA.dll and the image path does not begin with C:\Windows\System32\.
Correlate Discord process launches with recent file-write events creating WINSTA.dll in user-writable directories.
Apply YARA or hash-based rules against any DLLs discovered in Discord directories to identify non-Microsoft-signed binaries.

Monitoring Recommendations

Enable Sysmon Event ID 7 (Image Loaded) with rules that flag loads of system DLL names from non-standard paths.
Alert on file-creation events for *.dll inside %LocalAppData%\Discord and any directory containing Discord.exe.
Track integrity of the Discord install directory for unauthorized DLL additions between application updates.

How to Mitigate CVE-2025-4525

Immediate Actions Required

Inventory endpoints running Discord 1.0.9188 on Windows and prioritize them for review.
Restrict write permissions on Discord installation directories and any working directory used to launch Discord.
Remove any unexpected WINSTA.dll files found outside of C:\Windows\System32.
Educate users not to launch Discord from untrusted directories such as USB media, downloaded archives, or shared network folders.

Patch Information

No vendor advisory or patch reference is included in the CVE data. The CVE record notes that the vendor was contacted early but did not respond. Administrators should monitor Discord release notes and update to any newer client build as soon as a fix is published. Reference the VulDB #308270 entry for updates.

Workarounds

Launch Discord only from its default installation directory to avoid attacker-controlled working directories being searched first.
Apply AppLocker or Windows Defender Application Control policies to block unsigned DLLs from loading out of user-writable paths.
Enforce the CWDIllegalInDllSearch registry setting to remove the current working directory from the DLL search order for the Discord process.

bash

# Configuration example: enforce safe DLL search mode system-wide
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f

# Per-application override for Discord.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Discord.exe" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f