CVE-2025-59511 Overview
CVE-2025-59511 is a local privilege escalation vulnerability in the Windows WLAN Service. The flaw stems from external control of a file name or path [CWE-73], allowing an authorized attacker with low privileges to elevate to higher privileges on the local system. Microsoft published the advisory on November 11, 2025, and the issue affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2019 through 2025.
Critical Impact
An authenticated local attacker can manipulate file paths handled by the WLAN Service to gain elevated privileges, resulting in high impact to confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-11-11 - CVE-2025-59511 published to NVD and Microsoft security advisory released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59511
Vulnerability Analysis
The vulnerability resides in the Windows WLAN AutoConfig Service (wlansvc), which manages wireless network configuration and connectivity. The service processes file names or paths supplied through inputs that a low-privileged attacker can influence. Because these inputs are not adequately validated or canonicalized, an attacker can direct the service to reference or operate on attacker-controlled paths.
Exploitation requires local access and authenticated user privileges but no user interaction. Successful exploitation yields elevated privileges in the security context of the WLAN Service, which runs with SYSTEM-level rights. This produces high impact to confidentiality, integrity, and availability on the target host.
Root Cause
The root cause is classified as CWE-73: External Control of File Name or Path. The WLAN Service accepts path or file name data from an interface reachable by a local, authenticated user. It then uses that data in privileged file operations without sufficient sanitization. This design permits path manipulation techniques such as symbolic link redirection, directory traversal, or reparse-point abuse against files accessed by the SYSTEM-level service.
Attack Vector
The attack vector is local and requires low privileges. A standard user process on the machine interacts with WLAN Service interfaces to submit or influence a controlled path. The service then performs a file operation on that path under SYSTEM context, allowing the attacker to redirect writes, reads, or deletions to sensitive locations. See the Microsoft CVE-2025-59511 Advisory for authoritative technical details.
Detection Methods for CVE-2025-59511
Indicators of Compromise
- Unexpected file creations, modifications, or deletions in privileged directories performed by svchost.exe hosting wlansvc.
- Creation of symbolic links, junctions, or reparse points by low-privileged users in directories touched by the WLAN Service.
- Anomalous child processes or token manipulation originating from the WLAN Service process tree.
Detection Strategies
- Monitor Sysmon Event IDs 1 (process create), 11 (file create), and 15 (file stream create) associated with wlansvc operations on non-standard paths.
- Correlate WLAN Service activity with file system events involving reparse points or path traversal patterns such as ..\ sequences.
- Baseline normal file access patterns for the WLAN AutoConfig Service and alert on deviations, especially writes outside %ProgramData%\Microsoft\Wlansvc.
Monitoring Recommendations
- Enable object access auditing on sensitive system directories referenced by network configuration services.
- Aggregate endpoint telemetry into a centralized data lake for retroactive hunting once exploitation techniques are published.
- Track privilege changes on user accounts following interactions with wlansvc RPC or configuration interfaces.
How to Mitigate CVE-2025-59511
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-59511 Advisory to all affected Windows client and server systems.
- Prioritize patch deployment on multi-user hosts, jump servers, and Remote Desktop Session Hosts where local users are common.
- Audit local user accounts and remove unnecessary interactive logon rights on servers.
Patch Information
Microsoft addressed CVE-2025-59511 in the November 2025 security update cycle. Administrators should consult the vendor advisory to identify the specific KB article and cumulative update matching each affected build, then deploy through Windows Update, WSUS, Microsoft Endpoint Configuration Manager, or Intune. Restart affected systems to complete installation of the WLAN Service fix.
Workarounds
- Where the WLAN Service is not required, such as on wired-only servers, set the WlanSvc service to Disabled to remove the attack surface.
- Restrict interactive and local logon rights so untrusted users cannot invoke the vulnerable code path.
- Enforce application control policies to prevent execution of unauthorized tooling that could stage symlink or path-manipulation primitives.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
