CVE-2025-59319: CryptoPro Secure Disk Privilege Escalation

CVE-2025-59319 Overview

CVE-2025-59319 affects CPSD CryptoPro Secure Disk for Bitlocker in versions prior to v7.7.4. The product fails to verify the integrity of the intended boot partition. Instead, it selects the first partition matching a hardcoded type value. An attacker with high privileges can insert a crafted Linux partition ahead of the intended target. That partition executes in a high-privilege pre-boot context, enabling code execution during the disk unlock flow. The weakness is classified as authentication bypass by spoofing [CWE-290].

Critical Impact
A malicious partition placed before the legitimate boot partition executes in the pre-boot BitLocker unlock context, undermining full-disk encryption assurances and enabling privileged code execution.

Affected Products

CPSD CryptoPro Secure Disk for Bitlocker versions prior to v7.7.4
Endpoints relying on CryptoPro Secure Disk pre-boot authentication for BitLocker
Systems configured to boot from the affected pre-boot environment

Discovery Timeline

2026-08-12 - CVE-2025-59319 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database
Research disclosed in the Black Hat USA presentation and white paper titled The Cost of Obscurity

Technical Details for CVE-2025-59319

Vulnerability Analysis

CryptoPro Secure Disk for Bitlocker provides a pre-boot authentication layer that unlocks BitLocker-protected volumes. During boot, the component enumerates disk partitions and selects a target using a hardcoded partition type identifier. The loader stops at the first matching partition index without validating the content or integrity of that partition. This design permits substitution of the intended boot payload with attacker-supplied code. Because the code runs in the pre-boot environment, it executes before the operating system loads and outside standard OS security controls. Successful exploitation compromises the trust boundary that full-disk encryption is meant to enforce.

Root Cause

The root cause is missing cryptographic verification of the boot partition combined with reliance on a static partition type value for target selection. Selecting the first index that matches a well-known type is a trust-by-position decision rather than a trust-by-identity decision, aligning with [CWE-290] authentication bypass by spoofing.

Attack Vector

An attacker with high privileges on the system, or with physical or administrative access sufficient to modify the partition table, inserts a crafted Linux partition using the expected type identifier. That partition appears earlier in the enumeration order than the legitimate CryptoPro boot partition. On the next boot, the pre-boot loader picks the attacker partition and transfers execution to attacker-controlled code with pre-boot privilege. Details are described in the Black Hat research materials linked in the CPSD blog and the Black Hat white paper.

No verified public exploit code is available. See the referenced Black Hat research for technical detail.

Detection Methods for CVE-2025-59319

Indicators of Compromise

Unexpected additional partitions on disks protected by CryptoPro Secure Disk for Bitlocker, particularly partitions matching the same type identifier as the legitimate boot partition
Changes to the partition table timestamp or layout on encrypted endpoints that were not initiated by IT provisioning
Presence of Linux filesystem signatures on partitions inserted before the CryptoPro boot partition on a Windows endpoint

Detection Strategies

Baseline the partition layout of managed endpoints running CryptoPro Secure Disk and alert on deviations from the expected count, order, and GUID of partitions
Monitor for offline modifications to disks, including boot from external media, that could enable partition table tampering
Review installed CryptoPro Secure Disk versions across the fleet and flag any host still running versions prior to v7.7.4

Monitoring Recommendations

Collect boot integrity telemetry, including TPM PCR values, and alert on unexpected changes to measurements associated with pre-boot components
Log all administrative disk management activity (diskpart, partition editors, WMI storage APIs) on endpoints with full-disk encryption
Correlate boot-time anomalies with prior administrative privilege escalation or credential theft events

How to Mitigate CVE-2025-59319

Immediate Actions Required

Upgrade CPSD CryptoPro Secure Disk for Bitlocker to v7.7.4 or later on all affected endpoints
Inventory endpoints that depend on CryptoPro pre-boot authentication and prioritize those handling sensitive or regulated data
Restrict local administrator rights on affected endpoints to reduce the population of principals capable of modifying the partition table

Patch Information

CPSD addresses the flaw in CryptoPro Secure Disk for Bitlocker v7.7.4. Consult the CPSD blog for release notes and update procedures. The underlying research and remediation guidance are described in the Black Hat 2026 presentation The Cost of Obscurity.

Workarounds

Enforce full boot chain measurement with TPM and validate PCR values before releasing BitLocker key material where supported
Physically secure endpoints and disable boot from removable media in firmware to reduce opportunity for offline partition tampering
Monitor partition table integrity with endpoint tooling and alert on unauthorized changes until the patch can be deployed

bash

# Verify installed CryptoPro Secure Disk version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*CryptoPro Secure Disk*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Enumerate partitions on the system disk to review layout
Get-Disk | Where-Object IsBoot -eq $true | Get-Partition |
  Select-Object DiskNumber, PartitionNumber, Type, Size, Offset