CVE-2025-62572: 
vulnerability analysis and mitigation

CVE-2025-62572 is an out-of-bounds read vulnerability in Windows Application Information Services that allows a locally authenticated attacker with low privileges to elevate their privileges on the affected system. It was disclosed and patched on December 9, 2025, as part of Microsoft's December 2025 Patch Tuesday security update. Affected products include Windows 11 versions 24H2 and 25H2, and Windows Server 2025 (including Server Core installations). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC, BleepingComputer).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), mapped to CAPEC-540 (Overread Buffers), and resides in the Application Information Services component of Windows — the service responsible for facilitating the running of applications with elevated privileges (e.g., UAC elevation). An attacker with a low-privileged local account can trigger the out-of-bounds read condition, which may be leveraged to achieve privilege escalation without requiring user interaction. No public technical write-ups or proof-of-concept code have been identified at this time (Microsoft MSRC, ZDI Blog).

Successful exploitation allows an authorized local attacker to escalate privileges to a higher level, potentially achieving full system compromise. The vulnerability has high confidentiality, integrity, and availability impact ratings, meaning an attacker could read sensitive data, modify system configurations, or disrupt system availability. Given that Application Information Services is integral to UAC and privilege management, exploitation could enable an attacker to gain SYSTEM-level access from a standard user account (Microsoft MSRC, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.06%, indicating a low probability of exploitation in the near term. Exploitation requires local authenticated access with low privileges and no user interaction, which limits the attack surface compared to remote vulnerabilities (Microsoft MSRC, ZDI Blog).

Microsoft released security updates on December 9, 2025, addressing this vulnerability. Organizations should update to the following minimum versions: Windows 11 24H2 to build 10.0.26100.7392 or later, Windows 11 25H2 to build 10.0.26200.7392 or later, and Windows Server 2025 to build 10.0.26100.7392 or later. As interim measures, administrators should restrict local user access and privileges, and monitor for suspicious privilege escalation activity. No configuration-based workaround has been published by Microsoft (Microsoft MSRC, Lansweeper).

The vulnerability was covered as part of broader December 2025 Patch Tuesday roundups by multiple security outlets including BleepingComputer, Sophos, and the Zero Day Initiative, which noted it among the 57 vulnerabilities addressed that month. No specific researcher commentary or notable social media discussion focused exclusively on CVE-2025-62572 has been identified, as attention was largely directed at the three zero-days patched in the same update cycle (BleepingComputer, Sophos, ZDI Blog).