CVE-2025-9869: 
NixOS vulnerability analysis and mitigation

The Razer Synapse 3 Macro Module contains a local privilege escalation vulnerability (CVE-2025-9869) that was discovered and reported on March 30, 2025. This vulnerability affects installations of Razer Synapse 3 and allows local attackers to escalate privileges by exploiting a flaw in the Razer Synapse Service through link following (ZDI Advisory).

The specific vulnerability exists within the Razer Synapse Service. An attacker can abuse the service by creating a symbolic link to delete arbitrary files. The vulnerability has a CVSS v3.1 score of 7.8 (High) with the following vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system (ZDI Advisory).

A successful exploit allows an attacker to leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM, effectively gaining full control over the affected system (ZDI Advisory).

The vulnerability has been fixed in Razer Synapse 3 version 3.10.730.71519. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).

The vulnerability was discovered by security researcher 0xalibabas (x.com/0xalibabas) and was coordinated through the Zero Day Initiative's disclosure program (ZDI Advisory).