Windows Storage Elevation of Privilege Vulnerability (CVE-2025-21391) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-21391) is an Elevation of Privilege (EoP) vulnerability residing in the Windows Storage component. The root cause is associated with improper link resolution (CWE-59, Link Following) during file operations conducted by high-privileged storage services. When a privileged service performs file creation, modification, or deletion within a directory accessible by a low-privileged user, the service fails to properly validate whether the target path is a symbolic link or an NTFS junction point, allowing arbitrary file manipulation.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first gain local access to the target system with low-privilege execution capabilities. The attacker identifies a specific directory or file path that the Windows Storage service accesses with SYSTEM privileges. By creating a malicious symbolic link or junction point at that location, the attacker redirects the service's file operations to a protected system file (such as a system DLL or service executable). When the privileged service writes to the path, it follows the link and overwrites the target system file with the attacker's payload, resulting in local privilege escalation to SYSTEM upon the next execution or service trigger.

3. Infrastructure & Business Impact

This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. While local privilege escalation requires prior access, it is a critical component of multi-stage cyberattacks. Once inside a network, threat actors leverage such vulnerabilities to bypass security controls, compromise domain controllers, and gain full administrative control over the infrastructure, leading to severe data breaches and operational disruption.