CVE-2025-62572: High Priority Windows Appinfo Elevation Patch Guidance

Microsoft’s security telemetry shows a new Windows elevation‑of‑privilege advisory tied to the Application Information Service under the identifier CVE‑2025‑62572, and system administrators should treat it as a high‑priority patching item: the vendor listing classifies the flaw as an out‑of‑bounds read that can be abused by a local, authorized attacker to elevate privileges (CVSS v3.1 base ~7.8).

Background​

The Application Information Service (commonly referred to as Appinfo or Application Information) is a built‑in Windows service used to facilitate the launch of interactive applications with elevated privileges, and it participates in the user‑consent and elevation flow for User Account Control (UAC). Vulnerabilities in such privileged services are routinely significant because they provide a direct path from a lower‑privileged process (or a local attacker) into SYSTEM‑level operations when successfully exploited. The MSRC advisory for CVE‑2025‑62572 lists the vulnerability as an out‑of‑bounds read within Application Information Service code and maps the CVE to Microsoft’s Security Update Guide entry for remediation. At the time of publication, third‑party trackers and vulnerability indexes have recorded the CVE and assigned a High severity rating (CVSS 3.1 = 7.8), reporting the attack vector as local (an attacker needs to run code or influence local inputs) and the impact as Elevation of Privilege (high confidentiality/integrity/availability consequences if exploited). These external listings corroborate the MSRC entry and provide independent confirmation that the vulnerability is real and serious for unpatched systems.

---

What the vendor says (briefly)​

Microsoft’s Security Update Guide page for CVE‑2025‑62572 is the authoritative entry for affected builds and the KB mapping. The Update Guide page confirms:

• Vulnerability class: Out‑of‑bounds read (CWE‑125).
• Impact: Elevation of Privilege.
• Attack vector: Local — requires local actor or process control.
• Remediation: Microsoft will publish (or has published) security updates mapped to each supported Windows build; administrators must use the Update Guide to identify the exact KB/patch for each SKU.

Because Microsoft sometimes renders full advisory content via JavaScript and the Update Guide page is the vendor’s source of truth for KB→SKU mapping, IT teams should use the Update Guide and the Microsoft Update Catalog when building deployment plans. Automating patching by CVE string alone is risky: always verify the KB that applies to your precise OS build and servicing branch.

---

Technical summary — what the vulnerability is, in plain terms​

• The bug is described as an out‑of‑bounds read inside the Application Information Service. An out‑of‑bounds read occurs when code accesses memory outside the intended buffer, which can cause information leakage, crashes, or, in some cases, lead to memory corruption that an attacker can turn into code‑execution or token manipulation. The MSRC advisory classifies the fault as an OOB read and the broader tracking feeds annotate the weakness as CWE‑125.
• The attack model recorded in public feeds is a local elevation‑of‑privilege: an attacker with the ability to run code as a standard or authorized user (or an already compromised process) may be able to trigger the flaw and convert that foothold into elevated SYSTEM privileges. This makes CVE‑2025‑62572 especially dangerous as a second‑stage exploit in multi‑step attacks (phishing → low‑privileged execution → local EoP → persistence).
• Public feeds do not indicate a remote, unauthenticated attack vector for this CVE. Instead, the attack surface is local: the attacker must influence an Appinfo invocation or related IPC call that runs in a privileged service context. This distinction matters operationally because mitigation priorities differ for remote vs local vectors.

Caveat: At disclosure time Microsoft’s advisory style often limits low‑level exploit details to reduce short‑term weaponization. Where independent researchers publish exploit write‑ups, treat method‑level claims (exact function names, allocation patterns, or PoC code) as researcher findings until corroborated by multiple independent analyses or vendor technical notes.

---

Why this matters to Windows administrators​

• Privileged placement: Application Information often runs under elevated contexts and participates in UAC elevation flows. A successful local EoP here can convert a normal user compromise into a complete host compromise. That includes disabling security tooling, implanting persistent backdoors, or harvesting credentials. The operational risk is therefore high for endpoints and servers where local accounts or untrusted apps can be executed.
• Enterprise impact: In managed environments the flaw can be abused against administrative workstations, build servers, developer desktops, or VDI pools where users run untrusted code. Once SYSTEM is obtained, attackers can pivot to management planes, tamper with patching infrastructure, or persist across reboots. This is the canonical local‑EoP escalation path security teams must prioritize.
• Blast radius: While the vector is local, the ease of getting a local foothold (malicious documents, phishing -> execution, remote desktop abuse) combined with a reliable local EoP can make this vulnerability highly valuable to attackers seeking to broaden access. Aggressive patching reduces the attacker’s amplification options.

---

What’s confirmed and what remains uncertain​

Confirmed

• Microsoft published an Update Guide entry for CVE‑2025‑62572 and links remediation to security updates — that is the vendor confirmation of existence.
• Independent vulnerability aggregators have cataloged the CVE, assigned a CVSS v3.1 base score around 7.8, and listed the weakness as CWE‑125 (Out‑of‑bounds read). This corroboration increases confidence in the advisory metadata.
• The attack vector is recorded as local (not remotely exploitable without local code execution).

Unverified / Not yet public

• There are no widely‑distributed, vendor‑endorsed technical exploit write‑ups in the public domain at the time the Update Guide entry was published. If a proof‑of‑concept appears in independent researcher blogs or public repos, defenders should treat it as a high‑risk signal but still verify reliability and scope before acting on exploit‑level indicators.

If your environment requires zero‑touch automation (e.g., for tens of thousands of endpoints), rely on MSRC KB mappings rather than CVE text alone. Third‑party CVE aggregators sometimes mislabel affected SKUs or fail to account for supersedence, which leads to patch gaps.

---

Immediate operational guidance (0–72 hours)​

1. Identify affected assets
   • Query Microsoft’s Security Update Guide for CVE‑2025‑62572 and extract the KB number(s) that apply to each Windows build in your estate. The Update Guide is the canonical KB→SKU mapping point; do not rely solely on third‑party CVE lists.
2. Prioritize patching
   • Prioritize administrative workstations, developer machines, jump‑hosts, build systems, and any devices that allow users to execute untrusted code or where users have elevated privileges. Patch these systems first via your normal patch channels (WSUS, SCCM/ConfigMgr, Intune, or your enterprise patch management tool).
3. If you cannot patch immediately, apply compensating controls
   • Reduce exposure by tightening local execution policies, enforcing least privilege, and applying application allow‑listing (WDAC/AppLocker) on high‑value hosts.
   • Temporarily reduce the number of users who can run unsigned or unapproved executables.
   • For sensitive assets, consider isolating them on management VLANs or applying host firewall rules to restrict unnecessary local services. These are stop‑gap measures — the patch remains the primary fix.
4. Validate and monitor
   • After deploying the vendor KB, verify installation across endpoints (patch compliance checks, SCCM/Intune reporting).
   • Increase EDR/SIEM monitoring for local privilege escalation behaviors (unexpected SYSTEM process creation, token manipulation, changes to scheduled tasks or services). Collect forensic artifacts if you suspect exploitation (memory snapshots, relevant event logs).

---

Detection and hunting guidance​

Even local EoP attempts leave artifacts defenders can hunt for. Use these prioritized hunting signals:

• Service crashes: Look for Application Information (Appinfo) service instability, crash dumps, or Service Control Manager events indicating unexpected faults around elevation events. Unexpected service faults preceding suspicious process creation are red flags.
• Process creation anomalies: Monitor for non‑privileged processes that spawn elevated processes or SYSTEM‑context processes unexpectedly. Correlate event ID logs for process creation and token use with user session activity.
• Abuse of elevation flows: Track UAC elevation prompts and related process parents; anomalous chains where user processes cause SYSTEM‑context processes to execute command shells, PowerShell, or install services are strong indicators.
• Configuration and persistence artifacts: After suspected exploitation, hunt for unexpected service installations, new scheduled tasks, changed registry Run keys, or tampering of security agents. Attackers often persist after EoP by creating local services or scheduled tasks.
• Behavioral detections: EDR rules that detect token duplication, process hollowing, or suspicious use of Windows API calls associated with privilege manipulation should be enabled and tuned for false positives.

If you discover signs of exploitation, isolate the host immediately, collect volatile evidence (memory, process lists, network connections), and follow incident response playbooks for local privilege escalation incidents.

---

Patching checklist — step‑by‑step​

1. Use the Microsoft Security Update Guide to look up CVE‑2025‑62572 and note the exact KB number for each OS build in your environment. Do not assume a single KB applies to all branches; Microsoft maps by SKU.
2. Test the vendor KB in a representative lab or staging ring before broad deployment to ensure there are no regressions in your environment (especially relevant for servers or systems with delicate management software).
3. Deploy via your normal channels:
   • WSUS/SCCM: Approve the KB and push to pilot ring → validate → rollout.
   • Intune: Assign update rings and monitor compliance.
   • Manual: For isolated or air‑gapped hosts, obtain the KB package from Microsoft Update Catalog and follow the update instructions.
4. Reboot hosts when required and validate that the updated binaries are loaded. Many servicing updates require reboots for the fix to take effect.
5. Confirm remediation via patch reporting tools and verify that the Update Catalog / Windows Update shows the system as patched for CVE‑2025‑62572.
6. If you detect any suspicious pre‑patch activity around the Appinfo service, preserve forensic artifacts and treat the host as potentially compromised even after patching; remediation may require rebuilds from known‑good images.

---

Risk analysis and critical appraisal​

Strengths of Microsoft’s advisory model in this case

• Vendor confirmation: The presence of a Security Update Guide entry provides the authoritative KB→SKU mapping necessary for accurate remediation planning.
• Standardized severity: The CVSS v3.1 score (~7.8) gives administrators a consistent severity signal to prioritize response.
• Ecosystem corroboration: Multiple third‑party aggregators have indexed the CVE quickly, indicating the issue is recognized broadly across the security community.

Risks, limitations and operational friction

• Local vector nuance: Because the attack requires local action, defenders might deprioritize the fix for internet‑facing servers and focus on remote RCEs. That would be a mistake: in modern attacks, local EoP bugs are routinely chained with remote footholds (phishing attachments, malicious macros, remote code execution in other software). The overall risk remains real.
• Patch mapping complexity: CVE‑based automation can misapply fixes if your tooling maps incorrectly to the KB for your specific build. Always confirm KB applicability for each build; Microsoft’s Update Guide is the authoritative reference.
• Sparse public technical details: Microsoft’s short advisory format reduces immediate public exploit information — that’s good for limiting opportunistic weaponization but increases demand for defensive instrumentation and proactive patching. Administrators must act without waiting for independent PoCs.
• Forensic challenges: Local EoP exploitation often leaves fewer conspicuous network indicators; defenders must rely on endpoint telemetry, process lineage, and memory forensics to detect post‑exploit actions. Strengthening EDR and local logging is therefore essential.

---

Long‑term recommendations (beyond the patch)​

• Harden endpoint privilege boundaries: Enforce the principle of least privilege and minimize the number of users with local administrative rights. Use privilege management solutions to reduce unnecessary elevation events.
• Application allow‑listing: Deploy Windows Defender Application Control (WDAC) or AppLocker where feasible to reduce the attack surface for local code execution.
• Elevation process monitoring: Instrument and log Appinfo/UAC flows, elevation prompts, and elevation‑related process creation to catch suspicious elevation patterns early.
• Rapid KB mapping automation: Build operational scripts or internal runbooks that map MSRC Update Guide entries to KBs and then to specific images and CPE records in your asset inventory; this prevents CVE→KB mismatch errors in large estates.
• Keep a tested rollback and rebuild playbook: For hosts suspected of compromise, the safest remediation can be to isolate and rebuild from a known‑good image — particularly for administrative endpoints and servers that host management tools.

---

Conclusion​

CVE‑2025‑62572 is a high‑priority Windows elevation‑of‑privilege advisory rooted in an out‑of‑bounds read in the Application Information Service. Microsoft’s Security Update Guide lists the CVE and maps it to vendor updates; independent vulnerability trackers confirm the report and rate it High (CVSS ≈ 7.8). Administrators should immediately map the CVE to the KBs for their specific Windows builds, patch high‑risk assets first (administrative workstations, developer systems, jump hosts), and apply compensating controls where immediate patching isn’t feasible. Monitor endpoint telemetry for signs of local privilege escalation, and follow a conservative incident response posture if you detect suspicious activity around Appinfo or UAC elevation events.

---

Appendix — Quick reference (actions in order)

1. Lookup CVE‑2025‑62572 in Microsoft Security Update Guide and note KB per build.
2. Test the KB in a staging ring, then deploy to high‑risk hosts.
3. If immediate patching is impossible, restrict elevation abilities and tighten local admin rights.
4. Enable EDR hunts for elevation tokens, unexpected SYSTEM process launches, and Application Information service crashes.
5. For confirmed compromises, isolate, collect volatile evidence, and rebuild from known‑good images.

(End of article)

---

Source: MSRC Security Update Guide - Microsoft Security Response Center