Windows Search サービスにおける権限昇格の脆弱性

This vulnerability allows a local attacker to escalate their privileges on a targeted system. An attacker could potentially gain control over the entire system, install malicious software, steal sensitive data, or disrupt operations. The impact is particularly severe in environments where user accounts have limited privileges, as exploitation could bypass these security controls. While the vulnerability requires local access, it represents a significant risk in scenarios involving insider threats or compromised user accounts.

Organizations running Windows 10 versions prior to 10.0.26100.2894 are at risk, particularly those with a large number of user accounts or systems with limited privilege configurations. Environments where local administrative access is frequently granted to non-administrative users are also at increased risk.

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID = 4688 -MessageText '*\Windows Search*'">

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*searchindexer*'}

• windows / supply-chain: Check Autoruns for unusual entries related to the Windows Search Service. • windows / supply-chain: Monitor Windows Defender for alerts related to privilege escalation attempts involving the Windows Search Service.

1. 2025-01-14Disclosure

   disclosure

1. 予約済み2024-12-10
2. 公開日2025-01-14
3. 更新日2026-02-13
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-21292 is to upgrade to Windows version 10.0.26100.2894 or later, which includes the security patch. If immediate patching is not possible, consider implementing least privilege principles to limit the potential impact of a successful exploit. Review user account permissions and restrict access to sensitive resources. Monitor system logs for suspicious activity related to the Windows Search Service.