CVE-2025-58727

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.6456
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.6456
MicrosoftWindows 11 version 22H2>= 10.0.22621.0, < 10.0.22621.6060
MicrosoftWindows 11 version 22H3>= 10.0.22631.0, < 10.0.22631.6060
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.6060
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.6899
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.6899
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.1913
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.6899
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.6899

References

Timeline

Published
Oct 14, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-587287.8Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2025-587296.5Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a nCVE-2025-58736.3A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the filCVE-2025-587307.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587317.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587327.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587337.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587347.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587357.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587367.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587377.0Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.CVE-2025-587387.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
CVE-2025-58727: High severity, CVSS 7.0 | Vulnix