CVE-2025-7676

DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-04.txt

Configurations

No configuration.

History

29 Jul 2025, 14:14

Type	Values Removed	Values Added
Summary		(es) Secuestro de DLL de todos los ejecutables PE32 al ejecutarse en Windows para la arquitectura de CPU ARM64. Esto permite a un atacante ejecutar código si logra instalar una DLL en el mismo directorio que el ejecutable. Las versiones vulnerables de Windows 11 para ARM intentan cargar DLL base que normalmente no se cargarían desde el directorio de la aplicación. Corregido en la versión 24H2, pero presente en todas las versiones anteriores de Windows 11 para CPU ARM.

28 Jul 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-28 17:15

Updated : 2025-07-29 14:14

NVD link : CVE-2025-7676

Mitre link : CVE-2025-7676

CVE.ORG link : CVE-2025-7676

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-7676", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "ot-cert@dragos.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-28T17:15:34.303", "references": [{"url": "https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-04.txt", "source": "ot-cert@dragos.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ot-cert@dragos.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs."}, {"lang": "es", "value": "Secuestro de DLL de todos los ejecutables PE32 al ejecutarse en Windows para la arquitectura de CPU ARM64. Esto permite a un atacante ejecutar c\u00f3digo si logra instalar una DLL en el mismo directorio que el ejecutable. Las versiones vulnerables de Windows 11 para ARM intentan cargar DLL base que normalmente no se cargar\u00edan desde el directorio de la aplicaci\u00f3n. Corregido en la versi\u00f3n 24H2, pero presente en todas las versiones anteriores de Windows 11 para CPU ARM."}], "lastModified": "2025-07-29T14:14:29.590", "sourceIdentifier": "ot-cert@dragos.com"}