This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A Local Privilege Escalation (LPE) flaw in `Host Process for Windows Tasks`.β¦
π‘οΈ **Root Cause**: **CWE-59** (Improper Link Resolution Before File Access). The `taskhostw.exe` process deletes directories matching a specific GUID pattern without verifying if they are **symbolic links**.β¦
π₯οΈ **Affected Products**: **Windows 11 Version 25H2** (both ARM64 and x64-based systems). π¦ **Component**: `Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration` scheduled task.
Q4What can hackers do? (Privileges/Data)
π **Attacker Capabilities**: Elevate privileges from **Low User** to **SYSTEM/Admin**. π Access sensitive data, modify system integrity, and achieve full persistence.β¦
π **Threshold**: **Low/Medium**. π **Requirements**: Local access (AV:L), Low Complexity (AC:L), and **Low Privileges** (PR:L) are needed. No user interaction (UI:N) required.β¦
π **Self-Check**: 1. Check if Windows 11 25H2 is installed. 2. Verify the existence of the scheduled task: `Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration`. 3.β¦
π₯ **Urgency**: **HIGH**. π¨ CVSS Vector is **8.8 (High)**. Since PoC is public and requires only local low-privilege access, immediate patching is critical to prevent system takeover. Do not delay!