CVE-2025-21420
📋 TL;DR
This vulnerability allows an authenticated attacker to exploit the Windows Disk Cleanup Tool to gain SYSTEM-level privileges on affected systems. It affects Windows systems where the Disk Cleanup Tool is present and accessible. Attackers need local access to the system to exploit this privilege escalation flaw.
💻 Affected Systems
- Windows Disk Cleanup Tool
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access gains full SYSTEM privileges, enabling complete system compromise, data theft, malware persistence, and lateral movement across the network.
Likely Case
Privileged attackers or malware with initial foothold escalate to SYSTEM to bypass security controls, install backdoors, or access protected resources.
If Mitigated
With proper access controls and monitoring, exploitation attempts are detected and contained before significant damage occurs.
🎯 Exploit Status
Requires local authenticated access and specific conditions to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420
Restart Required: No
Instructions:
1. Open Windows Update Settings. 2. Check for updates. 3. Install all available security updates. 4. Verify installation via Windows Update history.
🔧 Temporary Workarounds
Restrict Disk Cleanup Tool Access
allLimit execution of cleanmgr.exe to authorized users only via Group Policy or file permissions
icacls %windir%\system32\cleanmgr.exe /deny Users:(RX)
🧯 If You Can't Patch
- Implement strict least privilege access controls to limit local user privileges
- Monitor for suspicious Disk Cleanup Tool executions and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Windows version and installed updates against Microsoft advisoryCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify security update KB number is installed via Windows Update history📡 Detection & Monitoring
Log Indicators:
- Unexpected cleanmgr.exe executions
- Privilege escalation events in security logs
- Suspicious process creation from Disk Cleanup
Network Indicators:
- None - local exploitation only
SIEM Query:
Process Creation where Image contains 'cleanmgr.exe' and Parent Process not in expected list