CVE-2025-59325: CryptoPro Secure Disk Info Disclosure Flaw

CVE-2025-59325 Overview

CVE-2025-59325 affects CPSD CryptoPro Secure Disk for Bitlocker versions before v7.7.4. The product fails to encrypt the contents of the initramfs, leaving pre-boot components and embedded secrets exposed on disk. An attacker with offline access to the storage medium can extract cryptographic material and configuration secrets without breaking the underlying BitLocker cryptography. The flaw undermines the confidentiality guarantees expected from a pre-boot authentication and full-disk encryption product.

Critical Impact
An attacker with physical or offline access to an affected system can recover secrets and cryptographic details from the unencrypted initramfs, enabling downstream compromise of the protected volume.

Affected Products

CPSD CryptoPro Secure Disk for Bitlocker versions prior to v7.7.4

Discovery Timeline

2026-08-12 - CVE-2025-59325 published to NVD
2026-08-12 - Last updated in NVD database
Public technical disclosure presented at Black Hat USA (see references)

Technical Details for CVE-2025-59325

Vulnerability Analysis

CPSD CryptoPro Secure Disk for Bitlocker provides pre-boot authentication that layers on top of Microsoft BitLocker. The pre-boot environment relies on a Linux initramfs image to render the authentication UI, collect credentials, and unlock the BitLocker-protected volume. In versions before v7.7.4, this initramfs is stored on disk without encryption. Any secrets, keys, configuration data, or proprietary logic embedded in the image are readable by anyone who can mount the storage medium.

The vulnerability maps to weak or missing cryptography for data at rest in a security-critical boot component. Because the exposed material relates to the encryption workflow itself, disclosure of these artifacts can weaken or bypass protections that the product is designed to enforce.

Root Cause

The root cause is a design decision that leaves the initramfs on the unencrypted portion of the disk. Sensitive material required by the pre-boot flow is bundled into that image without additional protection. There is no runtime-only key derivation or hardware-bound sealing described for these contents, so anyone with read access to the raw disk can recover them.

Attack Vector

Exploitation requires offline access to the storage device. Attack paths include stolen or lost laptops, opportunistic access to powered-off machines, evil-maid scenarios, seized backups, and forensic images of decommissioned drives. The attacker mounts the boot partition, extracts the initramfs, and inspects it for secrets and cryptographic details. No code execution on the running system is required. Full technical detail is available in the Black Hat USA presentation and white paper referenced below.

See the Black Hat Presentation PDF and Black Hat White Paper PDF for the disclosed methodology.

Detection Methods for CVE-2025-59325

Indicators of Compromise

Unauthorized mounting of the boot partition or evidence of forensic imaging on an endpoint protected by CPSD CryptoPro Secure Disk for Bitlocker.
Presence of an installed CPSD CryptoPro Secure Disk for Bitlocker version prior to v7.7.4 in software inventory.
Missing chain-of-custody events for lost, stolen, or decommissioned endpoints running the affected product.

Detection Strategies

Inventory endpoints using CPSD CryptoPro Secure Disk for Bitlocker and compare installed versions against v7.7.4 as the minimum fixed release.
Correlate physical asset events (loss, theft, RMA, disposal) with endpoints running affected versions to identify assets that may have been exposed to offline extraction.
Review boot partition and initramfs file integrity on managed systems to detect tampering after a device leaves controlled custody.

Monitoring Recommendations

Alert on any offline access indicators, such as devices returning from repair with modified boot partitions or unexpected initramfs timestamps.
Monitor vendor advisories at the CPSD Security Blog for updates and additional fixed versions.
Track credential and key rotation status for any account or key material that may have been embedded in the pre-boot environment of affected hosts.

How to Mitigate CVE-2025-59325

Immediate Actions Required

Upgrade all installations of CPSD CryptoPro Secure Disk for Bitlocker to v7.7.4 or later.
Treat any device running an affected version that has left physical custody as potentially exposed and rotate secrets that were reachable from the pre-boot environment.
Enforce strict physical security and chain-of-custody controls for endpoints pending patch deployment.

Patch Information

CPSD addresses the issue in CryptoPro Secure Disk for Bitlocker v7.7.4. Refer to the CPSD Security Blog for release notes and upgrade guidance. Apply the update across all managed endpoints and validate the installed version after deployment.

Workarounds

Where immediate patching is not possible, restrict physical access to affected endpoints and enable tamper-evident controls on boot media.
Avoid storing high-value secrets in configurations that would be bundled into the pre-boot initramfs on unpatched systems.
Increase telemetry from endpoint agents to identify anomalous offline access or boot-time modifications on affected hosts.

bash

# Verify installed CPSD CryptoPro Secure Disk for Bitlocker version on Windows endpoints
# and flag hosts below the fixed release (v7.7.4).
Get-WmiObject -Class Win32_Product |
  Where-Object { $_.Name -like "*CryptoPro Secure Disk*" } |
  Select-Object Name, Version |
  ForEach-Object {
    if ([version]$_.Version -lt [version]"7.7.4") {
      Write-Output "VULNERABLE: $($_.Name) $($_.Version)"
    } else {
      Write-Output "OK: $($_.Name) $($_.Version)"
    }
  }