CVE-2025-59185

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-591865.5Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2025-591877.8Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-591885.5Exposure of sensitive information to an unauthorized actor in Windows Failover Cluster allows an authorized attacker to disclose informationCVE-2025-591897.0Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.CVE-2025-59196.5The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modificatCVE-2025-591905.5Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.CVE-2025-591917.8Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.CVE-2025-591927.8Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.CVE-2025-591937.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authoriCVE-2025-591947.0Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-591957.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorCVE-2025-591967.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized att
CVE-2025-59185: Medium severity, CVSS 6.5 | Vulnix