CVE-2025-55317: Microsoft Autoupdate Privilege Escalation

CVE-2025-55317 Overview

CVE-2025-55317 is a local privilege escalation vulnerability in Microsoft AutoUpdate (MAU) on macOS. The flaw stems from improper link resolution before file access, classified as [CWE-59]. An authorized local attacker can abuse symbolic or hard links to manipulate files accessed by the privileged AutoUpdate process. Successful exploitation lets the attacker elevate privileges on the local system, gaining higher-integrity access than originally granted.

Microsoft published the advisory on September 9, 2025. The vulnerability carries a CVSS 3.1 score of 7.8 and requires local access with low privileges. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
A local, authenticated user on macOS can leverage link-following flaws in Microsoft AutoUpdate to gain elevated privileges, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft AutoUpdate (MAU) for macOS
Any macOS host running the vulnerable Microsoft AutoUpdate component prior to the fixed release
Microsoft 365 and Office for Mac deployments relying on MAU for patch delivery

Discovery Timeline

2025-09-09 - CVE-2025-55317 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55317

Vulnerability Analysis

Microsoft AutoUpdate runs privileged helper components on macOS to download and install updates for Microsoft applications. The vulnerability arises because MAU resolves file paths without properly validating whether a path component is a symbolic link or hard link. When the privileged helper writes to, reads from, or changes ownership of a file, an attacker-controlled link can redirect that operation to a target chosen by the attacker.

An authorized local user can pre-plant a link inside a directory writable by their account. When MAU later performs a privileged file operation against the expected path, it follows the link and acts on a sensitive system location instead. This allows the attacker to overwrite protected files, plant executable payloads, or modify configuration owned by root. The result is code execution or file modification at a privilege level the attacker does not otherwise hold.

Root Cause

The root cause is a link-following defect [CWE-59]. The privileged updater performs file operations without verifying that intermediate path components are regular directories or that the final target is not a symlink. It also fails to open files with flags such as O_NOFOLLOW or to use safe path-resolution APIs that reject links.

Attack Vector

Exploitation requires local access and a low-privileged account on the affected macOS host. The attacker prepares a symbolic or hard link inside a path that MAU will access during an update or self-repair operation. Triggering the update workflow, either by waiting for a scheduled check or invoking MAU manually, causes the privileged process to follow the attacker's link and perform file operations against sensitive locations. Because MAU runs with elevated rights, the attacker inherits the ability to write, delete, or execute code as a higher-privileged user.

No verified public exploit code is available. Refer to the Microsoft CVE-2025-55317 Advisory for vendor-specific technical details.

Detection Methods for CVE-2025-55317

Indicators of Compromise

Unexpected symbolic or hard links inside directories used by Microsoft AutoUpdate, such as /Library/Application Support/Microsoft/MAU2.0/ and ~/Library/Application Support/Microsoft AutoUpdate/
Files owned by root appearing in user-writable locations shortly after an AutoUpdate run
Modifications to Microsoft application binaries or LaunchDaemons following execution of Microsoft AutoUpdate.app or its helper tools

Detection Strategies

Monitor the macOS Unified Log and Endpoint Security events for symlink, link, and rename operations performed within MAU-managed directories.
Alert on privileged file writes by Microsoft Update Assistant.app or com.microsoft.autoupdate.helper that target paths outside expected update directories.
Compare pre- and post-update file inventories to detect writes to /Library/LaunchDaemons/, /usr/local/, or other privileged locations triggered by MAU.

Monitoring Recommendations

Enable macOS Endpoint Security telemetry (ES_EVENT_TYPE_NOTIFY_LINK, ES_EVENT_TYPE_NOTIFY_RENAME, ES_EVENT_TYPE_NOTIFY_WRITE) and forward to a central analytics platform.
Track process execution of MAU helper binaries and correlate with subsequent file operations at high privilege.
Baseline legitimate AutoUpdate activity so anomalous link creation or file redirection can be flagged quickly.

How to Mitigate CVE-2025-55317

Immediate Actions Required

Update Microsoft AutoUpdate to the fixed release identified in the Microsoft CVE-2025-55317 Advisory on every macOS endpoint.
Inventory macOS hosts running Microsoft 365 or Office for Mac and confirm they are receiving the patched MAU version.
Restrict local shell access on shared or multi-user macOS systems until patching completes.

Patch Information

Microsoft has released an updated version of Microsoft AutoUpdate that corrects the link-following behavior. Administrators should apply the patch through MAU itself, through managed software distribution such as Jamf or Intune, or by deploying the latest Microsoft 365 for Mac installer package. Refer to the Microsoft CVE-2025-55317 Advisory for exact fixed build numbers.

Workarounds

Enforce least-privilege on macOS endpoints so standard users cannot create links in directories consulted by privileged updaters.
Disable automatic AutoUpdate checks on high-value hosts until the patched version is deployed, then re-enable.
Audit and remove any pre-existing symbolic or hard links in MAU working directories before applying the update.

bash

# Verify the installed Microsoft AutoUpdate version on macOS
defaults read "/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/Info.plist" CFBundleShortVersionString

# List suspicious links in MAU directories
sudo find "/Library/Application Support/Microsoft/MAU2.0" -type l -ls
find "$HOME/Library/Application Support/Microsoft AutoUpdate" -type l -ls