CVE-2025-59291: Azure Compute Gallery Privilege Escalation

CVE-2025-59291 Overview

CVE-2025-59291 is a local privilege escalation vulnerability affecting Microsoft Azure Compute Gallery, specifically impacting Confidential Azure Container Instances. The flaw stems from external control of a file name or path [CWE-73], allowing an authorized attacker with high privileges to influence file references processed by the service. Successful exploitation lets the attacker elevate privileges locally on the target host. Microsoft published the advisory on October 14, 2025, and the entry was last updated in the National Vulnerability Database on June 17, 2026. The Exploit Prediction Scoring System (EPSS) currently rates exploitation probability at 0.414% with a percentile of 34.52.

Critical Impact
An authorized local attacker can manipulate file paths within Confidential Azure Container Instances to gain higher privileges, compromising confidentiality, integrity, and availability of the workload.

Affected Products

Microsoft Azure Compute Gallery
Confidential Azure Container Instances (ACI) workloads referencing gallery images
Azure tenants relying on gallery-hosted confidential container images

Discovery Timeline

2025-10-14 - CVE-2025-59291 published to the National Vulnerability Database
2025-10-14 - Microsoft releases advisory for CVE-2025-59291
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-59291

Vulnerability Analysis

The vulnerability resides in how Confidential Azure Container Instances handle file names or paths sourced from external input. When the service processes attacker-influenced path values, it fails to constrain those references to expected locations. This behavior maps to [CWE-73]: External Control of File Name or Path. An authorized attacker with high privileges (PR:H) can leverage this weakness from a local context (AV:L) without user interaction (UI:N). Because the scope changes (S:C), the impact extends beyond the vulnerable component to affect other resources within the confidential compute boundary. Successful exploitation yields high impact to confidentiality, integrity, and availability.

Root Cause

The root cause is insufficient validation and canonicalization of file path parameters accepted by the Confidential ACI runtime when it interacts with images sourced from the Azure Compute Gallery. External input flows into file system operations without adequate normalization, allowing an authenticated caller to point the service at unintended files or locations. This weakens the isolation guarantees expected from confidential container workloads.

Attack Vector

Exploitation requires local access and pre-existing high-privilege credentials on the affected Azure environment. The attacker manipulates file name or path inputs consumed by Confidential ACI to redirect file resolution to attacker-controlled or otherwise sensitive locations. Because the attack crosses trust boundaries, the resulting privilege escalation can affect adjacent components inside the confidential compute scope. See the Microsoft CVE-2025-59291 Advisory for vendor-specific exploitation context.

// No verified public exploit code is available for CVE-2025-59291.
// Refer to the Microsoft Security Response Center advisory for vendor guidance.

Detection Methods for CVE-2025-59291

Indicators of Compromise

Unexpected file access patterns from Confidential ACI processes referencing paths outside the container image root.
Azure Activity Log entries showing anomalous image references or gallery interactions from privileged principals.
Unusual privilege escalation events on hosts running Confidential Azure Container Instances.

Detection Strategies

Correlate control-plane API calls against the Azure Compute Gallery with subsequent runtime file operations inside Confidential ACI.
Monitor high-privilege identities for activity that references gallery images with unusual path parameters or metadata.
Baseline expected file paths used by confidential container workloads and alert on deviations.

Monitoring Recommendations

Enable Microsoft Defender for Cloud coverage on subscriptions running Confidential ACI and Azure Compute Gallery.
Forward Azure Activity Logs, Resource Logs, and container runtime telemetry to a centralized SIEM for correlation.
Alert on privilege changes and unexpected role assumptions tied to gallery or ACI operations.

How to Mitigate CVE-2025-59291

Immediate Actions Required

Apply the Microsoft-provided service update as referenced in the Microsoft CVE-2025-59291 Advisory.
Audit and reduce the number of principals holding high-privilege roles over Azure Compute Gallery and Confidential ACI.
Rotate credentials and access keys for any identity that may have interacted with affected resources.

Patch Information

Microsoft addressed CVE-2025-59291 through a service-side fix delivered to Confidential Azure Container Instances and the Azure Compute Gallery. Because these are managed Azure services, the mitigation is applied by Microsoft on the platform side. Customers should confirm remediation status via the Microsoft CVE-2025-59291 Advisory and validate their deployments against the guidance published there.

Workarounds

Restrict access to the Azure Compute Gallery using Azure role-based access control (RBAC) and Privileged Identity Management (PIM) just-in-time elevation.
Enforce Conditional Access and multi-factor authentication for administrative access to affected subscriptions.
Isolate sensitive Confidential ACI workloads in dedicated subscriptions with strict network and identity boundaries until patch confirmation.

bash

# Example: enumerate role assignments on an Azure Compute Gallery to review privileged principals
az role assignment list \
  --scope "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG>/providers/Microsoft.Compute/galleries/<GALLERY_NAME>" \
  --output table