CVE-2025-59033

Katalog CVE

CVSS 7.4 · High EPSS 0,28%

Kerentanan Unprotected Alternate Channel. Skor CVSS 3.1 7.4 (High) menurut mitre.org.

Deskripsi (NVD)

The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.

Rincian

Terbit di NVD

8 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.4 (High), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-420: Unprotected Alternate Channel
CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-bu...
• https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of...
• https://x.com/JonnyJohnson_/status/1895103112924307727