Loading story…
Microsoft published security updates for a cluster of Windows Digital Media and Windows Media elevation-of-privilege vulnerabilities, including CVE-2025-21226, CVE-2025-21228, CVE-2025-21229, CVE-2025-21255, CVE-2025-21256, CVE-2025-21260, CVE-2025-21265, CVE-2025-21324, CVE-2025-21327, and CVE-2025-32716. The issues were listed in Microsoft’s Security Update Guide as local privilege escalation bugs affecting Windows media-related components.
The bulk of the advisories identify Windows Digital Media Elevation of Privilege Vulnerability entries, while CVE-2025-32716 is tracked as a Windows Media Elevation of Privilege Vulnerability, indicating a broader set of media-handling components were affected. Microsoft provided update-guide entries for each CVE, signaling that organizations should prioritize applying the relevant Windows security updates to reduce the risk of attackers gaining elevated privileges on vulnerable systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft added a Security Update Guide entry for CVE-2025-32716, described as a Windows Media Elevation of Privilege vulnerability. The advisory was published on June 10, 2025.
Microsoft published a Security Update Guide entry for CVE-2025-21310, a Windows Digital Media Elevation of Privilege vulnerability, as part of the January 14, 2025 Patch Tuesday release.
Microsoft published a Security Update Guide entry for CVE-2025-21258, a Windows Digital Media Elevation of Privilege vulnerability, as part of the January 14, 2025 Patch Tuesday release.
Microsoft published a Security Update Guide entry for CVE-2025-21232, a Windows Digital Media Elevation of Privilege vulnerability, as part of the January 14, 2025 Patch Tuesday release.
Microsoft released Security Update Guide entries for multiple Windows Digital Media Elevation of Privilege vulnerabilities, including CVE-2025-21226, CVE-2025-21228, CVE-2025-21229, CVE-2025-21255, CVE-2025-21256, CVE-2025-21260, CVE-2025-21265, CVE-2025-21324, and CVE-2025-21327. The references indicate these advisories were published as part of the January 14, 2025 update cycle.
17 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 3, 2026
Microsoft published security advisories for a series of **Windows elevation-of-privilege** vulnerabilities affecting the **Windows Kernel**, **File Explorer**, **Windows Management Service**, **Windows UI XAML Phone DatePickerFlyout**, **Windows Graphics Component**, **Windows Storage**, and the **DirectX Graphics Kernel**. The referenced flaws include `CVE-2026-26132`, `CVE-2025-62565`, `CVE-2025-54103`, `CVE-2025-54111`, `CVE-2025-55693`, `CVE-2024-38249`, `CVE-2025-62573`, `CVE-2024-38248`, and `CVE-2025-55678`. The disclosures indicate a broad patching effort spanning core operating system subsystems and user-facing Windows components, with repeated exposure in privileged areas such as the kernel and graphics stack. For defenders, the concentration of elevation-of-privilege issues across these components raises the risk that attackers could chain local access or code execution with privilege escalation to gain **SYSTEM-level** or otherwise expanded rights on affected Windows systems, making prompt validation and deployment of Microsoft updates a priority.
Jun 29, 2026
Microsoft has issued security advisories for multiple **Desktop Window Manager (DWM) Core Library** elevation-of-privilege vulnerabilities affecting Windows, including `CVE-2022-21902`, `CVE-2022-41096`, `CVE-2024-43629`, `CVE-2025-21304`, and `CVE-2025-53801`. The flaws were published across several update cycles through the Microsoft Security Response Center, indicating a recurring security issue in the component responsible for Windows desktop composition and rendering. The advisories identify the vulnerabilities as **elevation of privilege** issues in the Windows or Microsoft DWM Core Library, meaning successful exploitation could allow an attacker with existing access to gain higher privileges on a targeted system. Microsoft released fixes through its Security Update Guide and related portal advisories, making patching a priority for organizations that rely on Windows endpoints and servers where the DWM component is present.
Jul 3, 2026