CVE-2025-49738 is a local privilege escalation vulnerability affecting Microsoft PC Manager, stemming from improper link resolution before file access (link following). An authorized attacker can exploit this with low attack complexity to gain full control over the system, impacting confidentiality, integrity, and availability. While rated as high severity (CVSS 7.8), there is currently no public exploit code, and it is not known to be actively exploited, though it has garnered some community and media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.17.4.0CPE matchmatch criteria | cpe:2.3:a:microsoft:pc_manager:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.