CVE-2025-49680 Overview
CVE-2025-49680 is a local denial-of-service vulnerability in the Windows Performance Recorder (WPR) component. The flaw stems from improper link resolution before file access, classified under [CWE-59]. An authorized local attacker who plants a crafted symbolic or hard link can trick WPR into operating on an unintended target file, causing a service disruption on the affected system.
Microsoft has issued a security update through the Microsoft Security Response Center. The vulnerability requires local access, low privileges, and user interaction to exploit successfully.
Critical Impact
A local, authenticated attacker can leverage a link-following flaw in Windows Performance Recorder to deny service and impact confidentiality, integrity, and availability on the target host.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-07-08 - CVE-2025-49680 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49680
Vulnerability Analysis
Windows Performance Recorder is a built-in tracing tool that captures system and application performance data. The vulnerability occurs when WPR accesses files without properly resolving links before opening them. An attacker who controls a directory or file path used by WPR can substitute a symbolic link or NTFS junction that redirects the operation to a sensitive target.
Because WPR may run with elevated privileges when triggered by an administrator or scheduled tracing session, the redirected write or delete operation can affect files the attacker could not otherwise modify. The result is a corruption or removal of system-relevant files, leading to a local denial-of-service condition. The vulnerability requires user interaction, meaning an administrator or another privileged user must initiate the WPR action while the malicious link is in place.
Root Cause
The root cause is a link-following weakness [CWE-59]. WPR fails to verify that a path it is about to open resolves to the intended file object rather than a link pointing elsewhere. This time-of-check to time-of-use pattern is a well-known class of Windows file-handling defects that surfaces when privileged processes touch attacker-writable directories.
Attack Vector
Exploitation is local. An attacker with an authenticated foothold plants a link in a directory that WPR will process, then waits for or induces a privileged user to run a trace or profiling task. When WPR follows the planted link, the operation redirects to a system file, producing the denial-of-service outcome. No network access is required, and no code execution is achieved through this vulnerability alone.
No public proof-of-concept code is available for CVE-2025-49680. See the Microsoft Security Update CVE-2025-49680 advisory for authoritative technical guidance.
Detection Methods for CVE-2025-49680
Indicators of Compromise
- Creation of symbolic links, junctions, or hard links in directories accessed by wpr.exe or PerfCore tracing sessions by non-administrative users.
- Unexpected modification, truncation, or deletion of system files coinciding with WPR trace start or stop events.
- Windows Event Log entries showing WPR errors or aborted trace sessions on hosts where local users have recently created reparse points.
Detection Strategies
- Monitor process telemetry for wpr.exe invocations that touch files outside standard trace output directories such as %TEMP% or user-specified paths.
- Alert on the creation of NTFS reparse points by non-privileged accounts in directories used by administrative tools.
- Correlate WPR activity with subsequent file-integrity changes to critical system paths.
Monitoring Recommendations
- Enable Windows Sysmon Event IDs 11 (FileCreate) and 15 (FileCreateStreamHash) to capture link creation and file writes in sensitive directories.
- Track invocations of wpr.exe, PerfTrack, and related tracing binaries via EDR process telemetry.
- Baseline normal WPR usage patterns so that off-hours or unusual trace sessions surface as anomalies.
How to Mitigate CVE-2025-49680
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-49680 advisory to all affected Windows client and server systems.
- Inventory endpoints and servers running unpatched Windows 10, Windows 11, and Windows Server builds listed in the affected products section, and prioritize multi-user and shared systems.
- Restrict interactive logon rights on affected hosts to reduce the pool of accounts capable of planting malicious links.
Patch Information
Microsoft has released fixed builds through the standard monthly update channel. Refer to the Microsoft Security Update CVE-2025-49680 advisory for the specific KB article and cumulative update mapped to each affected Windows version.
Workarounds
- Avoid running Windows Performance Recorder trace sessions with elevated privileges on hosts where untrusted local users have write access to shared directories.
- Remove or tighten NTFS permissions on directories used by WPR so that only trusted accounts can create files or links there.
- Disable the SeCreateSymbolicLinkPrivilege for standard user accounts through Group Policy where operationally feasible.
# Group Policy path to restrict symbolic link creation
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > User Rights Assignment > "Create symbolic links"
# Remove standard users; retain only Administrators.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
