CVE-2025-59241
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Improper link resolution before file access ('link following') exists in Windows Health and Optimized Experiences Service. An authorized attacker can exploit this to elevate privileges locally.
Risk Assessment
An attacker with valid credentials can elevate privileges on the system, potentially leading to full host compromise.
Recommendation
Apply the Windows security update containing the fix for this vulnerability.
Other vulnerabilities in Windows Health and Optimized Experiences Service
See all- CVE-2026-96183Medium
Missing authentication for a critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
- CVE-2026-85884High
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS