CVE-2025-58727

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-587287.8Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2025-587296.5Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a nCVE-2025-58736.3A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the filCVE-2025-587307.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587317.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587327.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587337.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587347.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587357.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587367.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.CVE-2025-587377.0Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.CVE-2025-587387.0Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
CVE-2025-58727: High severity, CVSS 7.0 | Vulnix