Vulnerability · Published Nov 4, 2025 · Assigned by Gridware

CVE-2025-12683NULL DACL assigned to Named Pipe communicating with SYSTEM Service

Medium 5.8

In plain English

A medium-severity privilege mismanagement in Everything from Voidtools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 4.0)5.8Medium

Exploit odds (30 days)<0.1%top 99.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalation(only if chained with other elements) for a local low privilege user.

Affected products (as reported)

Vendor	Product	Versions
Voidtools	Everything	=<1.4.1.1029

Weakness: CWE-269 · Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Amber

References

https://www.voidtools.com/