Loading vulnerability…
CVE-2025-60710 is a local privilege escalation vulnerability in Microsoft Windows Host Process for Windows Tasks, also referred to as Windows Task Host. The flaw is caused by improper link resolution before file access, a classic link-following weakness in which the component resolves or accesses a file target in an unsafe manner. An authorized local attacker with basic user permissions can exploit this condition to influence file operations performed by the vulnerable process and elevate privileges. Microsoft and CISA describe the issue as affecting Windows 11 and Windows Server 2025, and successful exploitation can result in execution with SYSTEM privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (PoC) exploit for CVE-2025-60710, a local privilege escalation vulnerability in Microsoft Windows. The exploit targets the scheduled task \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration, which, when triggered, causes the system to delete directories in the user's %LOCALAPPDATA% without proper symlink checks. The exploit is implemented in C++ and consists of several source and header files, with the main logic in 'main.cpp' and 'FileOrFolderDelete.cpp'. The exploit works in two stages: first, it prepares the environment by creating a directory structure and setting up symbolic/junction links. The user is prompted to trigger the vulnerable delete operation (e.g., by starting the scheduled task). After the delete is triggered, the exploit resumes and leverages the SYSTEM context to perform privileged file operations, such as dropping a malicious DLL or manipulating rollback files via MSI installer tricks. The exploit uses Windows APIs for file operations, directory monitoring, and privilege escalation techniques based on file system manipulation. Key fingerprintable endpoints include the user's CoreAIPlatform.00\UKP directory, C:\Config.Msi, and HID.DLL in the Common Files directory. The exploit also interacts with the Windows registry to check for installer folder registration. The repository is structured as a Visual Studio C++ project, with resource files for embedded payloads (MSI, RBS, RBF). The README provides a technical overview and usage instructions, confirming the exploit's purpose and capabilities.
This repository contains a proof-of-concept (PoC) exploit for CVE-2025-60710, a local privilege escalation vulnerability in Microsoft Windows. The exploit targets the scheduled task \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration, which, when triggered, causes the system to delete directories in the user's %LOCALAPPDATA% without proper symlink checks. The exploit is implemented in C++ and consists of several source and header files, with the main logic in 'main.cpp' and 'FileOrFolderDelete.cpp'. The exploit works in two stages: first, it prepares the environment by creating a directory structure and setting up symbolic/junction links. The user is prompted to trigger the vulnerable delete operation (e.g., by starting the scheduled task). After the delete is triggered, the exploit resumes and leverages the SYSTEM context to perform privileged file operations, such as dropping a malicious DLL or manipulating rollback files via MSI installer tricks. The exploit uses Windows APIs for file operations, directory monitoring, and privilege escalation techniques based on file system manipulation. Key fingerprintable endpoints include the user's CoreAIPlatform.00\UKP directory, C:\Config.Msi, and HID.DLL in the Common Files directory. The exploit also interacts with the Windows registry to check for installer folder registration. The repository is structured as a Visual Studio C++ project, with resource files for embedded payloads (MSI, RBS, RBF). The README provides a technical overview and usage instructions, confirming the exploit's purpose and capabilities.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows Task Host privilege escalation vulnerability affecting Windows 11 and Windows Server 2025 that allows attackers to gain SYSTEM privileges.
A local privilege escalation vulnerability in Windows Task Host caused by improper link resolution before file access (link following), allowing an authorized attacker with basic user permissions to gain SYSTEM privileges.
A Windows link-following vulnerability that could facilitate privilege escalation.
A link following vulnerability affecting Microsoft Windows.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.