CVE-2025-59508

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-595095.5Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally.CVE-2025-595105.5Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attaCVE-2025-595117.8External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally.CVE-2025-595127.8Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.CVE-2025-595135.5Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally.CVE-2025-595147.8Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.CVE-2025-595157.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2025-595167.8Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.CVE-2025-595177.8Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.CVE-2025-595188.0In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ CVE-2025-59527.3A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the CVE-2025-595246.1Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, the file upload flow performs validation
CVE-2025-59508: High severity, CVSS 7.0 | Vulnix