Vulnerability · Published Jul 28, 2025 · Assigned by Dragos
CVE-2025-7676DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs
Medium 5.4
In plain English
A medium-severity uncontrolled search path in Windows 11 from Microsoft, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft, Inc | Windows 11 | 0 – before 24H2 |
Weakness: CWE-427 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N