CVE-2025-47181

🗓️ 22 May 2025 22:03:30Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 157 Views🌐 WEB

Improper link resolution in Microsoft Edge allows attackers to elevate privileges locally.

Reporter	Title	Published	Views	Family All 17
GithubExploit	Exploit for Link Following in Microsoft	23 May 202517:46	–	githubexploit
Information Security Automation	June Microsoft Patch Tuesday	10 Jun 202521:49	–	avleonov
BDU FSTEC	The vulnerability in the software for automatic checking of updates for the Microsoft Edge Update browser lies in the improper handling of symbolic links before accessing the file. This allows a malicious actor to elevate their privileges to a system level.	28 May 202500:00	–	bdu_fstec
Circl	CVE-2025-47181	22 May 202522:50	–	circl
CNNVD	Microsoft Edge 后置链接漏洞	22 May 202500:00	–	cnnvd
CNVD	Microsoft Edge (Chromium-based) Update elevation of privilege vulnerability (CNVD-2025-23057)	3 Jun 202500:00	–	cnvd
Cvelist	CVE-2025-47181 Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability	22 May 202522:03	–	cvelist
EUVD	EUVD-2025-20524	3 Oct 202520:07	–	euvd
Kaspersky	KLA83830 PE vulnerability in Microsoft Browser	22 May 202500:00	–	kaspersky
Tenable Nessus	Microsoft Edge (Chromium) < 1.3.195.61 (CVE-2025-47181)	22 May 202500:00	–	nessus

NVD

Vulners

CNA

Node

microsoft edge_updateRange<1.3.195.61

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Edge (Chromium-based) Updater",
    "versions": [
      {
        "version": "1.0.0.0",
        "lessThan": "1.3.195.61",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47181

Parameter	Position	Path	Description	CWE
TARGET_SENSITIVE_FILE	path	C:\Windows\System32\target.dll	Conceptual privilege escalation via symlink to a sensitive system file; a trusted write operation follows the symlink and overwrites the target.	CWE-59
SYMLINK_NAME	path	C:\Windows\System32\target.dll	Conceptual privilege escalation via symlink to a sensitive system file; a trusted write operation follows the symlink and overwrites the target.	CWE-59
FILE_TO_BE_WRITTEN_BY_EDGE	path	C:\Windows\System32\target.dll	Conceptual privilege escalation via symlink to a sensitive system file; a trusted write operation follows the symlink and overwrites the target.	CWE-59
EDGE_TEMP_DIR_ROOT	path	C:\EdgeUpdater\Temp\	Malicious symlink created inside a trusted temporary directory that could be followed by a privileged process.	CWE-59
SYMLINK_NAME	path	C:\EdgeUpdater\Temp\	Malicious symlink created inside a trusted temporary directory that could be followed by a privileged process.	CWE-59

17 Jun 2026 09:27Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.8

EPSS0.00491

SSVC

CWE-59