CVE-2025-59241 Overview
CVE-2025-59241 is a local privilege escalation vulnerability in the Windows Health and Optimized Experiences Service. The flaw stems from improper link resolution before file access, commonly known as link following [CWE-59]. An authorized local attacker can abuse symbolic links or junctions to redirect the service's privileged file operations to attacker-controlled targets. Successful exploitation elevates privileges on the affected host. Microsoft addressed the issue for Windows 11 24H2 and 25H2 through the Microsoft Security Update Guide.
Critical Impact
A low-privileged local user can escalate to elevated privileges by manipulating filesystem links processed by the Windows Health and Optimized Experiences Service, resulting in full compromise of confidentiality, integrity, and availability on the host.
Affected Products
- Microsoft Windows 11 24H2
- Microsoft Windows 11 25H2
- Windows Health and Optimized Experiences Service component
Discovery Timeline
- 2025-10-14 - CVE-2025-59241 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59241
Vulnerability Analysis
The Windows Health and Optimized Experiences Service performs file operations under elevated privileges. It does not adequately validate whether a target path is a symbolic link, junction, or hard link before opening or writing to it. A local user with standard authentication can plant a crafted link in a location the service touches. When the service resolves that path, it operates on the attacker-designated target instead of the intended file. This class of flaw is tracked as [CWE-59] link following. The vulnerability affects Windows 11 24H2 and 25H2 builds and does not require user interaction beyond the attacker's own session.
Root Cause
The service opens or modifies files without using link-resistant flags such as FILE_FLAG_OPEN_REPARSE_POINT or without verifying the final resolved path against expected security boundaries. Because the service runs at a higher integrity level than the attacker, redirection through a reparse point causes privileged writes to occur on attacker-controlled locations.
Attack Vector
Exploitation requires local access and a low-privileged authenticated session. The attacker creates a symbolic link, mount point, or object manager symlink pointing from a path the service reads or writes into a system-protected location. Triggering the service's file operation then produces an arbitrary file write, overwrite, or deletion in the SYSTEM context, which is chained into code execution or persistence.
No public proof-of-concept code has been released for CVE-2025-59241. Refer to the Microsoft Security Update Guide for authoritative technical detail.
Detection Methods for CVE-2025-59241
Indicators of Compromise
- Creation of symbolic links, NTFS junctions, or object manager symlinks by non-administrative users in directories referenced by the Health and Optimized Experiences Service.
- Unexpected file writes or overwrites in %SystemRoot%\System32 or other SYSTEM-owned paths originating from the service process.
- New or modified DLLs, scheduled tasks, or services appearing shortly after activity from the Health and Optimized Experiences Service.
Detection Strategies
- Monitor Sysmon Event ID 11 (FileCreate) and Event ID 15 for reparse point creation by unprivileged users under %ProgramData%, %TEMP%, and service-managed directories.
- Alert on Windows Security Event ID 4663 showing SYSTEM-level file writes to paths that were recently created or modified by a standard user.
- Correlate process activity from the Health and Optimized Experiences Service with subsequent creation of executables, DLLs, or auto-start entries.
Monitoring Recommendations
- Enable object access auditing on high-value directories to capture link resolution events.
- Ingest endpoint telemetry into a centralized data lake to correlate link creation with subsequent privileged file operations across the fleet.
- Track patch state for Windows 11 24H2 and 25H2 hosts and flag systems missing the October 2025 cumulative update.
How to Mitigate CVE-2025-59241
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows 11 24H2 and 25H2 endpoints.
- Inventory affected hosts and prioritize systems accessible to multiple interactive users, such as shared workstations and VDI images.
- Restrict interactive logon rights on servers and multi-user systems where feasible.
Patch Information
Microsoft has released a security update for CVE-2025-59241. The fix hardens link resolution in the Windows Health and Optimized Experiences Service so that privileged file operations no longer follow attacker-planted reparse points. Consult the Microsoft Security Update Guide for the specific KB article and build numbers applicable to Windows 11 24H2 and 25H2.
Workarounds
- No official workaround has been published by Microsoft; patching is the supported remediation path.
- Reduce exposure by removing local administrator caching and limiting standard users' ability to create symbolic links via the SeCreateSymbolicLinkPrivilege group policy setting.
- Enforce application control policies such as Windows Defender Application Control to limit execution of unexpected binaries dropped through arbitrary write primitives.
# Configuration example: restrict symbolic link creation to Administrators
# Group Policy path:
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > User Rights Assignment > Create symbolic links
#
# Verify current assignees:
whoami /priv | findstr SeCreateSymbolicLinkPrivilege
# Confirm patch installation for the October 2025 cumulative update:
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
