CVE-2025-38738: 
Dell SupportAssist for PCs vulnerability analysis and mitigation

CVE-2025-38738 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Dell SupportAssist for Home PCs Installer executable, affecting versions 4.8.2.29006 and prior (below 4.8.2.38851). A low-privileged local attacker can exploit this flaw to elevate their privileges on the affected system. The vulnerability was published on August 14, 2025, with a patch made available shortly after. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 6.7 (Medium) per ENISA's EUVD scoring (Dell Advisory).

The vulnerability is rooted in incorrect privilege assignment (CWE-266) within the SupportAssist for Home PCs Installer executable. During installation, the installer component improperly assigns or handles privileges, allowing a low-privileged local user to leverage this misconfiguration to gain elevated system access. Exploitation requires local access and low privileges, with no user interaction needed (per the NVD CVSS vector). No public proof-of-concept or detailed technical write-up has been identified at this time (Dell Advisory).

Successful exploitation allows a low-privileged local attacker to escalate their privileges on the affected Windows system. This could enable unauthorized access to sensitive system resources, modification of system configurations, installation of malicious software, and broader compromise of system integrity. The scope is limited to the local machine, but privilege escalation can serve as a critical stepping stone for further attack stages such as persistence or lateral movement (Dell Advisory).

Dell has released a patched version of SupportAssist for Home PCs (4.8.2.38851 and later) that addresses this vulnerability. Users should update to version 4.8.2.38851 or later immediately via Dell's official support website. As additional hardening measures, organizations should enforce least-privilege principles for local user accounts and monitor systems for unauthorized privilege escalation attempts (Dell Advisory).