Vulnerability details

CVE-2025-4525

Discord

Discord WINSTA.dll uncontrolled search path

CVSS 4.0

7.3High

Official description

A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS scores

Score	Version	Source	Vector
7.3High	4.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
7.0High	3.1	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
7.0High	3.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
6.0Medium	2.0	CVEProject cvelistV5 (CNA) (VulDB)	`AV:L/AC:H/Au:S/C:C/I:C/A:C`

Affected products

Vendor	Product	Versions	Source
—	Discord	1.0.9188	CVEProject cvelistV5 (CNA)

References and advisories

https://vuldb.com/?id.308270 vdb-entry
https://vuldb.com/?ctiid.308270 signaturepermissions-required
https://vuldb.com/?submit.562788 third-party-advisory
https://gist.github.com/shellkraft/ac4be6a3953e2889a7bf54aea2db88c2 exploit

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-05-11
Last updated: 2025-05-12
State: Published
Assigner (CNA): VulDB

Exploit prediction (EPSS)

0.35%

Probability of exploitation in 30 days

28.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-427
Uncontrolled Search Path
CWE-426
Untrusted Search Path