CVE-2025-59205

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-592067.4Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability CVE-2025-592077.8Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-592087.1Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network.CVE-2025-592095.5Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose infor CVE-2025-59215.8The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re CVE-2025-592107.4Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability CVE-2025-592115.5Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose infor CVE-2025-592138.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthoriz CVE-2025-592146.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over CVE-2025-592157.0Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2025-592167.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an author CVE-2025-592189.6Azure Entra ID Elevation of Privilege Vulnerability