OnlyPatch
Windows Installer

CVE-2025-27727 — Windows Installer Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00933 🔬 Patch diffed 2025-04 archive

Executive Summary

Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-59: Improper Link Resolution Before File Access ('Link Following')
Released Apr 8 2025
Last Updated Apr 8 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00933 — 0.57647 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00933
probability of exploitation in the next 30 days
0.57647 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

31 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5055547 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5055547 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5055521 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5055521 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5055519 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5055519 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5055523 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5055523 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5055561 (Monthly Rollup) 5055570 (Security Only) Important Elevation of Privilege 5053620 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27670 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5055561 (Monthly Rollup) 5055570 (Security Only) Important Elevation of Privilege 5053620 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27670 Yes None Windows Server 2012 5055581 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5055581 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5055557 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5055557 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5055521 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5055521 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5055519 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5055519 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5055526 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5055526 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5055527 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5055523 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5055523 (Security Update) Important Elevation of Privilege Yes

Patches

10 patches
Article Type Restart
5055547 Security Update Yes
5055521 Security Update Yes
5055519 Security Update Yes
5055518 Security Update Yes
5055528 Security Update Yes
5055523 Security Update Yes
5055581 Monthly Rollup Yes
5055557 Monthly Rollup Yes
5055526 Security Update Yes
5055527 Security Update Yes

Patch Diff

ghidriff (PDB symbols resolved from Microsoft symbol server) · msi.dll (KB5055523)

Logic vulnerability — TempPackages registry trust boundary violation in Windows Installer (msi.dll). CMsiTransaction::SetEEUIDirectoryAndFilter unconditionally calls ScheduleFileOrFolderDelete without feature flag check, writing attacker-controlled paths to TempPackages registry. CleanupTempPackagesInternal runs as SYSTEM and calls FDeleteFolder on every TempPackages entry with recursive deletion. Exploitation: C:\Config.Msi delete → NULL DACL re-creation → .rbs rollback script swap → SYSTEM code execution. Patch: Feature_1997029688 check prevents ScheduleFileOrFolderDelete call.

Pre-patch version 5.0.26100.3323 Download
Post-patch version 5.0.26100.3775 Download
Function Address Change Note
CMsiConfigurationManager::SetEEUIDirectoryAndFilter 18018ba10 code COM entry point. IsAdmin() check, CreateFileW with DELETE (0x10000), FILE_FLAG_OPEN_REPARSE_POINT (0x200000), calls CMsiTransaction::SetEEUIDirectoryAndFilter
CMsiTransaction::SetEEUIDirectoryAndFilter 18018bb90 code VULNERABLE — unconditionally calls ScheduleFileOrFolderDelete without Feature_1997029688 check in pre-patch. Post-patch adds feature flag gate.
ScheduleFileOrFolderDelete 1801af264 code CElevate(true), opens TempPackages registry key, writes folder-delete entry via SetValue (vtable 0x30)
CleanupTempPackagesInternal 180186c6c code CElevate(true), enumerates TempPackages, calls FDeleteFolder for entries with folder flag (& 2)
FDeleteFolder 1801b29ac code FindFirstFileW/FindNextFileW loop, DeleteFileW for files, recursive for subdirs, RemoveDirectoryW, LockdownPath + SetFileAttributesW(0) fallback
View full diff report View RCA report Download PoC

Attack Path

Arbitrary folder deletion as SYSTEM by planting paths into the Windows Installer TempPackages registry list

Attack path for CVE-2025-27727 Arbitrary folder deletion as SYSTEM by planting paths into the Windows Installer TempPackages registry list 01 — ENTRY Local user reaches the Windows Installer COM entry point CMsiConfigurationManager::SetEEUIDirectoryAndFilter. It performs an IsAdmin() check and opens the target with DELETE (0x10000) and FILE_FLAG_OPEN_REPARSE_POINT (0x200000). 02 — CONTROLLED INPUT Attacker supplies the directory path that gets recorded The path is written into the TempPackages registry list without validation of who supplied it. 03 — PATH CMsiTransaction::SetEEUIDirectoryAndFilter schedules the deletion It calls ScheduleFileOrFolderDelete unconditionally in the pre-patch build, crossing the trust boundary between a user-supplied path and a SYSTEM-processed work list. 04 — MISSING CHECK No feature-flag gate on the schedule call, so the trust boundary is never enforced Post-patch adds a Feature_1997029688 check around ScheduleFileOrFolderDelete. Pre-patch the write to TempPackages is unconditional. 05 — PRIMITIVE CleanupTempPackagesInternal runs as SYSTEM and recursively deletes every listed entry FDeleteFolder is applied to each TempPackages path. Chains with the C:\Config.Msi junction and MSI rollback technique for full SYSTEM code execution - same terminal step as CVE-2025-21420.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Simon (@sim0nsecurity)

On This Page