Actively exploited in the wild
Microsoft Windows Storage Link Following Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2025-02-11. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2025-21391
HighCVSS 7.1KEVExploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Windows Storage Elevation of Privilege Vulnerability.
Risk Assessment
The risk includes potential privilege escalation by a local attacker, which could lead to unauthorized access to data and system.
Recommendation
Apply the security updates released by Microsoft for Windows systems.
Other vulnerabilities in Windows Storage
See all- CVE-2026-96944Medium
Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.
- CVE-2026-83911High
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-69935High
Use after free vulnerability in Windows Storage. An authorized attacker can exploit this flaw to elevate privileges locally.
- CVE-2026-69931High
Race condition due to concurrent execution using a shared resource with improper synchronization in Windows Storage. An authorized attacker can exploit this flaw to elevate privileges locally.
- CVE-2026-69856High
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-69766High
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-69763High
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-102191High
A heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-102189High
A heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
- CVE-2026-100225High
A heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Windows Storage Elevation of Privilege Vulnerability
Vulnerability data from NVD (NIST) · CISA KEV · EPSS