CVE-2025-59033 Security feature bypass in Windows
Attackers may bypass Windows Defender Application Control driver blocklists by exploiting specific certificate qualifier handling, allowing execution of blocked drivers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59033?
CVE-2025-59033 is a high-severity vulnerability in Microsoft Windows, published on 8 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.
Which versions are affected by CVE-2025-59033?
How do I fix CVE-2025-59033?
No fix has been published for CVE-2025-59033 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-59033 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59033 exists.
Sources
Also known as GHSA-h935-vxwx-xh2m.