CVE-2025-9871: 
NixOS vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2025-9871) was discovered in Razer Synapse 3's Chroma Connect component. The vulnerability was reported on March 30, 2025, and publicly disclosed on September 30, 2025. This security flaw affects installations of Razer Synapse 3 and has been assigned a CVSS score of 7.8, indicating high severity (ZDI Advisory).

The vulnerability exists within the Razer Chroma SDK installer component of Razer Synapse 3. The specific flaw allows an attacker to abuse the installer by creating a symbolic link that can be exploited to delete arbitrary files. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity but local attack vector (ZDI Advisory).

If successfully exploited, this vulnerability allows an attacker to escalate privileges and execute arbitrary code in the context of SYSTEM. This means an attacker could gain the highest level of system privileges, potentially leading to complete system compromise (ZDI Advisory).

The vulnerability has been fixed in Razer Synapse 3 version 3.10.730.71519. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).

The vulnerability was discovered and reported by security researcher 0x_alibabas (x.com/0x_alibabas) (ZDI Advisory).