CVE-2025-21391

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 4 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

4.72%

probability

This CVE has a 4.72% probability of being exploited in the next 30 days.

0% Top 89.5th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Windows Storage Elevation of Privilege Vulnerability

Attack Intelligence

CWE-59 · Link Following CWE-664 · Improper Control of a Resource Through its Lifetime CWE-706 · Use of Incorrectly-Resolved Name or Reference

Google Project Zero

Patched

Feb. 11, 2025

Reported by

???

Root Cause Analysis

???

Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation

TheHackerNews

Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws

BleepingComputer Feb 11, 2025

Microsoft and Adobe Patch Tuesday, February 2025 Security Update Review

Qualys Feb 11, 2025

⚡ THN Weekly Recap: Google Secrets Stolen, Windows Hack, New Crypto Scams and More

TheHackerNews

Signal Intelligence

Confidenceⓘ

78%

EPSS 4.72%

Mentions 4

Last Seen Feb 11, 2025

CNA Information

Analyst Note

CVE-2025-21391 is confirmed as a zero-day elevation of privilege vulnerability in Windows 10, addressing a legitimate security flaw with a HIGH CVSS score of 7.1. The vulnerability was addressed in Microsoft's February 2025 Patch Tuesday release and is documented in reputable security publications, providing credible confirmation of its legitimacy.