cve 2025 59497

CVE-2025-59497 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Microsoft Defender for Endpoint on Linux. Discovered and disclosed by Microsoft, this flaw can be exploited by an authorized local attacker to cause a denial-of-service (DoS) condition. Microsoft released a security update on October 14, 2025 to address the issue. Administrators are advised to prioritize host-level remediation and enforce strict local access controls to mitigate the risk. The vulnerability affects the mdatp agent commonly used in enterprise environments for endpoint protection on Linux systems.