Loading vulnerability…
Windows Storage Privileged File Deletion
CVE-2025-21391 is an elevation-of-privilege vulnerability in Microsoft Windows Storage caused by improper link resolution before file access. A local authenticated attacker can exploit the link-handling flaw to delete targeted files beyond their authorized access. The vulnerability requires no user interaction, has a CVSS score of 7.1, and was actively exploited when Microsoft released its February 2025 security updates. It is included in CISA's Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthorized deletion of targeted files can compromise filesystem integrity and cause denial of service, including system unavailability when critical files are deleted. The demonstrated privilege escalation concerns privileged file deletion; arbitrary code execution or acquisition of a SYSTEM execution context is not established. The vulnerability does not directly disclose confidential information.
If you can’t patch tonight, do this now.
No specific workaround is provided. Prioritize deployment of the February 2025 Windows security updates, particularly on systems where local authenticated users may be untrusted.
Patch, then assume compromise.
Apply Microsoft's February 2025 security update addressing CVE-2025-21391 for the affected Windows release. Prioritize deployment because exploitation in the wild is confirmed. Specific fixed builds and update identifiers are currently not available in the supplied vulnerability details.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.