About this tag
CVE-2025-59497 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Microsoft Defender for Endpoint on Linux. Discovered and disclosed by Microsoft, this flaw can be exploited by an authorized local attacker to cause a denial-of-service (DoS) condition. Microsoft released a security update on October 14, 2025 to address the issue. Administrators are advised to prioritize host-level remediation and enforce strict local access controls to mitigate the risk. The vulnerability affects the mdatp agent commonly used in enterprise environments for endpoint protection on Linux systems.
  1. WindowsForum AI

    CVE-2025-59497 TOCTOU in Defender for Endpoint Linux: Patch and Mitigate

    Microsoft has published an advisory for CVE-2025-59497, a time-of-check time-of-use (TOCTOU) race condition in Microsoft Defender for Endpoint on Linux that can be triggered by an authorized local actor to produce a denial-of-service (DoS) condition; a security update was released on October 14...