CVE-2025-64456: JetBrains ReSharper Privilege Escalation

CVE-2025-64456 Overview

CVE-2025-64456 affects JetBrains ReSharper versions before 2025.2.4. The vulnerability stems from missing signature verification in the Dynamic Program Analysis (DPA) Collector component. A local attacker with low privileges can exploit this weakness to escalate privileges on affected Windows systems. JetBrains addressed the issue in ReSharper 2025.2.4 and documented the fix on its security advisory page.

The weakness is classified under CWE-347: Improper Verification of Cryptographic Signature. Because the DPA Collector loads or executes code without validating its signature, attackers can substitute a malicious payload that inherits the collector's elevated context.

Critical Impact
Local low-privileged users can achieve privilege escalation on developer workstations by supplying unsigned or attacker-controlled code to the ReSharper DPA Collector.

Affected Products

JetBrains ReSharper versions prior to 2025.2.4
JetBrains ReSharper DPA (Dynamic Program Analysis) Collector component
Windows developer workstations running vulnerable ReSharper installations

Discovery Timeline

2025-11-10 - CVE-2025-64456 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64456

Vulnerability Analysis

JetBrains ReSharper ships with a Dynamic Program Analysis (DPA) Collector that instruments running .NET processes to gather performance and allocation data. In versions prior to 2025.2.4, the Collector fails to verify cryptographic signatures on components it loads or executes. This omission breaks the trust chain expected between the signed ReSharper installation and the auxiliary binaries it invokes.

An attacker with an unprivileged local account can place a malicious binary or dependency where the Collector will load it. When ReSharper or a higher-privileged user invokes the Collector, the substituted code executes with the calling context's privileges. This produces a local privilege escalation from a standard user to the invoking user, which frequently includes administrative sessions on developer machines.

The vulnerability requires local access and low privileges, with no user interaction beyond triggering the normal DPA workflow. Confidentiality, integrity, and availability are all impacted because the attacker gains arbitrary code execution in the target context.

Root Cause

The root cause is the absence of Authenticode or equivalent signature validation before the DPA Collector loads external modules. Without verifying the publisher signature, the Collector treats any file matching the expected path or name as legitimate. This aligns with the classic CWE-347 pattern where trust is inferred from location rather than cryptographic proof.

Attack Vector

Exploitation requires the attacker to already hold a local account on the target system. The attacker stages a crafted DLL or executable in a directory the DPA Collector references, then waits for or induces the collector to run under a privileged account. Because ReSharper is commonly used by developers holding local administrator rights, successful exploitation typically yields elevated code execution.

No verified proof-of-concept exploit code is publicly available. See the JetBrains Security Issues Fixed advisory for vendor-confirmed details.

Detection Methods for CVE-2025-64456

Indicators of Compromise

Unsigned or unexpected DLLs present in ReSharper or DPA Collector working directories
DPA Collector processes spawning child processes not associated with the JetBrains toolchain
File creation events in ReSharper installation paths originating from non-administrative user accounts

Detection Strategies

Monitor process lineage for JetBrains.DPA.Runner or DPA Collector executables launching unexpected binaries or command interpreters
Alert on module load events where the DPA Collector loads DLLs signed by publishers other than JetBrains s.r.o.
Correlate low-privileged user file writes into ReSharper directories with subsequent execution of those files under elevated tokens

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image Loaded) with signature status logging for JetBrains processes
Track ReSharper version inventory across developer workstations to identify hosts below 2025.2.4
Review EDR telemetry for token elevation events tied to DPA Collector activity

How to Mitigate CVE-2025-64456

Immediate Actions Required

Upgrade JetBrains ReSharper to version 2025.2.4 or later on all developer workstations
Audit local ReSharper installations to confirm no unsigned binaries reside in DPA Collector directories
Restrict local administrative rights on developer endpoints where feasible to reduce escalation targets

Patch Information

JetBrains resolved this vulnerability in ReSharper 2025.2.4 by adding signature verification to the DPA Collector. Download the fixed release from JetBrains and consult the JetBrains Security Issues Fixed page for the authoritative advisory. Deploy the update through existing software distribution tooling to ensure consistent coverage.

Workarounds

Disable Dynamic Program Analysis in ReSharper settings until the patched version is deployed
Apply strict file system ACLs on ReSharper installation and cache directories to prevent write access by non-administrative users
Enforce application allowlisting via Windows Defender Application Control or AppLocker to block unsigned modules from loading into JetBrains processes

bash

# Example AppLocker publisher rule concept for JetBrains binaries
# Allow only modules signed by JetBrains s.r.o. to load in ReSharper contexts
New-AppLockerPolicy -RuleType Publisher -User Everyone -Optimize `
  -FileInformation (Get-AppLockerFileInformation -Path 'C:\Program Files (x86)\JetBrains\*.dll')