CVE-2025-56503: Sublime Text 4 Privilege Escalation Flaw

CVE-2025-56503 Overview

CVE-2025-56503 describes a reported privilege escalation issue in Sublime HQ Pty Ltd Sublime Text 4 build 4200. The report claims that an authenticated attacker with low-level privileges can escalate to Administrator by replacing the uninstall file in the installation folder with a crafted binary. The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment. Notably, the supplier disputes the finding, stating that replacing the uninstall file itself requires administrator permissions, which would negate the privilege escalation claim.

Critical Impact
If the installation directory permits write access to low-privileged users, an attacker could substitute the uninstaller with a malicious binary that executes with Administrator rights when triggered by a privileged user or the operating system.

Affected Products

Sublime HQ Pty Ltd Sublime Text 4, build 4200
Windows installations where the Sublime Text installation folder inherits weak permissions
Environments where standard users retain write access to the installation directory

Discovery Timeline

2025-11-10 - CVE-2025-56503 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database, reflecting the vendor dispute

Technical Details for CVE-2025-56503

Vulnerability Analysis

The reported issue centers on the uninstaller binary shipped with Sublime Text 4 build 4200. According to the submitter, a low-privileged user can overwrite the uninstall executable located in the Sublime Text installation folder with a crafted binary. When the uninstaller subsequently runs under an administrative context, the attacker-controlled code executes with Administrator privileges.

Sublime HQ disputes this classification. The vendor asserts that the installation folder resides under a protected system location where replacing files requires administrator rights, meaning no privilege boundary is crossed. The dispute reflects a common disagreement pattern in [CWE-266] reports: whether default filesystem access control lists (ACLs) allow the write primitive that the exploit chain requires.

The practical risk depends entirely on the deployment. Installations placed in user-writable directories, or those where administrators loosened NTFS permissions on Program Files subdirectories, would be exposed. Default Windows installations under C:\Program Files\ typically prevent the required write operation.

Root Cause

The reported root cause is insecure file permissions on the uninstaller executable within the installation directory. If a standard user can modify that binary, the trust boundary between user code and privileged uninstall operations collapses.

Attack Vector

An attacker with authenticated low-privilege access identifies the uninstaller path inside the Sublime Text installation folder. The attacker replaces the legitimate uninstaller with a crafted binary that performs actions of their choosing. When an administrator later launches the uninstaller through Programs and Features, appwiz.cpl, or an installer script, the crafted binary runs with elevated rights.

No verified proof-of-concept code is published in the referenced material. Consult the GitHub CVE-2025-56503 Repository for the submitter's write-up.

Detection Methods for CVE-2025-56503

Indicators of Compromise

Modification timestamps on the Sublime Text uninstaller executable that do not match the original installation or update event
Uninstaller binary hash that does not match the vendor-provided reference for build 4200
Unexpected child processes spawned by the uninstaller during administrator-initiated removal
New scheduled tasks, services, or persistence entries created immediately after an uninstall operation

Detection Strategies

Monitor file integrity on the Sublime Text installation directory, specifically the uninstaller binary
Alert on write operations to the installation folder performed by non-installer, non-administrator processes
Baseline the digital signature of the uninstaller and flag unsigned or newly signed replacements
Correlate elevated process creation events with prior write access to the same executable path

Monitoring Recommendations

Enable Windows Security event logging for object access on the Sublime Text installation directory
Ingest Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) into a centralized log platform for correlation
Review ACLs on third-party application installation folders quarterly to detect drift from secure defaults

How to Mitigate CVE-2025-56503

Immediate Actions Required

Verify NTFS permissions on the Sublime Text installation directory and remove write access for non-administrative users and groups
Confirm the uninstaller binary matches the vendor-supplied hash for the installed version
Restrict local administrative group membership and enforce User Account Control (UAC) prompts for elevation
Deploy Sublime Text only to protected locations such as C:\Program Files\ rather than user-writable paths

Patch Information

No vendor patch is referenced because Sublime HQ disputes the vulnerability. Sublime HQ's position is that the installation directory already requires administrator rights to modify, and therefore no code change is warranted. Organizations should validate that assertion in their own environments by inspecting effective permissions on the installation path.

Workarounds

Enforce standard Windows installation locations under Program Files where system ACLs restrict writes to administrators and TrustedInstaller
Apply application allowlisting through Windows Defender Application Control or AppLocker to block execution of unsigned uninstaller binaries
Configure file integrity monitoring on the uninstaller executable and alert on any modification
Remove write permissions for Users and Authenticated Users on the installation directory if inherited from a non-standard install location

bash

# Verify effective permissions on the Sublime Text install directory (PowerShell)
Get-Acl "C:\Program Files\Sublime Text" | Format-List

# Remove write access for standard users if drift is detected
icacls "C:\Program Files\Sublime Text" /remove:g "Users"
icacls "C:\Program Files\Sublime Text" /remove:g "Authenticated Users"

# Confirm uninstaller integrity against a known-good hash
Get-FileHash "C:\Program Files\Sublime Text\sublime_text.exe" -Algorithm SHA256