CVE-2025-62571: Windows 10 1607 Privilege Escalation Flaw

CVE-2025-62571 Overview

CVE-2025-62571 is an elevation of privilege vulnerability in the Windows Installer service. The flaw stems from improper input validation [CWE-20] and allows an authorized local attacker to elevate privileges on affected systems. Microsoft assigned the vulnerability a CVSS 3.1 base score of 7.8, and it affects a broad range of supported Windows client and server releases from Windows Server 2008 through Windows 11 25H2 and Windows Server 2025. The vulnerability was published to the National Vulnerability Database (NVD) on December 9, 2025.

Critical Impact
A local, authenticated attacker exploiting CVE-2025-62571 can gain SYSTEM-level privileges through the Windows Installer service, resulting in full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and Windows Server 2025

Discovery Timeline

2025-12-09 - CVE-2025-62571 published to NVD and addressed in the Microsoft Security Update Guide
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62571

Vulnerability Analysis

The vulnerability resides in Windows Installer (msiexec.exe and associated components), a service that runs with elevated privileges to install, modify, and remove software packages. Windows Installer accepts input during install operations, including Microsoft Installer (MSI) packages, transforms, and command-line parameters. Improper validation of one of these inputs allows an authorized local user to influence privileged operations performed by the installer.

Successful exploitation results in a local privilege escalation from a standard user context to SYSTEM. Because the attack is local and requires low-complexity user interaction without additional privileges beyond a valid account, exploitation is practical during post-compromise activity. The vulnerability requires no user interaction from a second party.

Root Cause

Microsoft classifies the underlying weakness as CWE-20: Improper Input Validation. Windows Installer fails to correctly validate attacker-influenced input before it is consumed by a privileged code path. This lets a low-privileged account drive the installer into performing an action that changes the security state of the system on the attacker's behalf.

Attack Vector

The attack vector is local and requires an authenticated user on the target host. A typical exploitation chain involves an attacker who already holds a foothold as a standard user, then invokes Windows Installer with crafted input to trigger the flawed validation path. No verified public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. Refer to the Microsoft Security Update Guide CVE-2025-62571 for authoritative technical details.

Detection Methods for CVE-2025-62571

Indicators of Compromise

Unexpected invocations of msiexec.exe by standard user accounts, especially with unusual command-line switches such as /i, /a, or TRANSFORMS= referencing user-writable paths
New services, scheduled tasks, or accounts created immediately after Windows Installer activity by a non-administrative user
MSI or MST files written to user-writable directories (%TEMP%, %APPDATA%, C:\Users\Public) and executed by the installer service

Detection Strategies

Baseline legitimate software deployment patterns and alert on msiexec.exe child processes that spawn shells, script interpreters, or LOLBins under the SYSTEM account following a standard-user invocation
Monitor Windows event logs for MsiInstaller events (Event IDs 1000-1042 in the Application log) correlated with token elevation events (Security 4672, 4688) from non-administrative parents
Deploy behavioral endpoint detection and response (EDR) analytics that identify token or integrity-level transitions originating from installer processes

Monitoring Recommendations

Forward Windows Installer, Sysmon process-creation, and Security audit logs to a centralized analytics platform for correlation
Track file creation events for .msi, .mst, and .msp files in user-writable locations
Alert on installations initiated outside approved software deployment windows or by accounts that are not members of software-management groups

How to Mitigate CVE-2025-62571

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide CVE-2025-62571 to all affected Windows client and server systems
Prioritize patching on multi-user hosts, jump servers, and terminal-services environments where local, low-privileged accounts are present
Audit local account membership and remove unnecessary interactive logon rights on high-value systems

Patch Information

Microsoft has released security updates for all supported affected versions, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 through Windows Server 2025. Consult the vendor advisory for specific Knowledge Base article numbers per operating system build and install via Windows Update, Microsoft Update Catalog, WSUS, or your enterprise patch-management platform.

Workarounds

No official workaround is documented by Microsoft; patching is the recommended remediation
Reduce exposure by restricting interactive and remote local logon to trusted administrative accounts through Group Policy
Consider setting the AlwaysInstallElevated policy to 0 in both HKLM and HKCU to prevent non-administrative users from installing MSI packages with elevated privileges

bash

# Verify AlwaysInstallElevated is disabled (should return 0 or not exist)
reg query "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
reg query "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated

# Explicitly disable if unset
reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated /t REG_DWORD /d 0 /f