Password Safe and Privilege Management
CVE-2025-2297: Privilege Management for Windows - Elevation of Privilege
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Privilege Management for Windows 0 | <25.4.270 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.