CVE-2025-64343: Conda Constructor Privilege Escalation

CVE-2025-64343 Overview

CVE-2025-64343 affects conda Constructor, a tool that builds installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. When installers run outside of restricted paths, the resulting directory permissions permit write access by any authenticated local user. Any logged-in user can modify installation files during both single-user and all-user installations. For single-user installations placed in shared directories, these permissive settings persist after installation completes. The issue is fixed in version 3.13.0.

Critical Impact
Local authenticated users can tamper with files during installation and, for shared single-user installs, retain write access afterward. This enables code substitution attacks against binaries and scripts inside the installation directory.

Affected Products

conda Constructor versions 3.12.2 and earlier
Installers produced by vulnerable Constructor versions on Windows (EXE installers)
Single-user and all-user installations placed in world-writable parent directories

Discovery Timeline

2025-11-07 - CVE-2025-64343 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64343

Vulnerability Analysis

The vulnerability is classified under [CWE-289] (Authentication Bypass by Alternate Name) and manifests as an insecure permissions issue on the installation target directory. Constructor-generated installers do not explicitly set restrictive access control entries on the installation directory. Instead, the directory inherits the ACL of its parent. When the parent is world-writable, such as many user-selectable paths outside of Program Files, any local authenticated user gains write access to the install tree.

During installation, an attacker with a local account can replace files being written by the installer. Post-installation, single-user installs in shared locations retain the same permissive ACL, allowing continuous tampering with the deployed application binaries and Python packages.

Root Cause

The installer logic does not enforce explicit permission hardening on the destination directory. Windows directory ACL inheritance causes the created installation folder to adopt whatever permissions the parent path provides. In non-restricted locations, this default includes write access for the Authenticated Users group.

Attack Vector

Exploitation requires local access with low privileges and no user interaction from the victim installer process. An attacker monitors the target installation path and either races the installer to replace files as they are written or modifies files after installation completes. The attack succeeds when the installed application is later executed by another user or with elevated privileges, resulting in code execution in that user's context.

text

// Patch notes from Constructor 3.13.0 release
+### Bug fixes
+
+* EXE: Remove write access for users during the installation process.
+* EXE: Remove write access for users except for the installing user from single-user installations.

Source: GitHub Commit c368383

Detection Methods for CVE-2025-64343

Indicators of Compromise

Unexpected modification timestamps on files inside a conda Constructor installation directory shortly after install
Presence of Authenticated Users:(M) or Authenticated Users:(W) ACL entries on installed application folders outside of Program Files
Constructor-built installer executables generated with constructor version <= 3.12.2

Detection Strategies

Audit ACLs on directories created by Constructor-based installers using icacls <install_path> and flag write permissions granted to non-administrative principals.
Inventory installed products built with Constructor and correlate their build version against the fixed release 3.13.0.
Monitor for file writes to installed application directories by processes running under user accounts other than the installer or an administrator.

Monitoring Recommendations

Enable file integrity monitoring on directories produced by Anaconda, Miniconda, Miniforge, and other Constructor-based distributions.
Log Windows Security Event ID 4663 for object access on installation folders located outside of %ProgramFiles%.
Alert on modifications to .exe, .dll, .py, and .pyc files within Constructor-built installation trees performed by unprivileged users.

How to Mitigate CVE-2025-64343

Immediate Actions Required

Upgrade conda Constructor to version 3.13.0 or later before generating new installers.
Re-issue installers for any distributions previously built with Constructor <= 3.12.2 and distribute updated versions to end users.
Manually restrict ACLs on existing installations located in shared or user-writable paths.

Patch Information

The fix is delivered in conda Constructor 3.13.0. The patch removes write access for standard users during the installation process and, for single-user installs, restricts write access to the installing user only. See the GitHub Security Advisory GHSA-vvpr-2qg4-2mrq and the GitHub Release 3.13.0 for full details.

Workarounds

Install Constructor-built packages only into restricted directories such as %ProgramFiles% where inherited ACLs deny write access to standard users.
After installation, manually remove the Authenticated Users write permission from the installation directory using icacls.
Restrict interactive logon to systems where Constructor-based installers are executed to reduce local attacker exposure.

bash

# Harden an existing Constructor-based installation directory on Windows
icacls "C:\Path\To\Installation" /remove:g "Authenticated Users"
icacls "C:\Path\To\Installation" /remove:g "Users"
icacls "C:\Path\To\Installation" /inheritance:r
icacls "C:\Path\To\Installation" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"