https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204 Before screenshot. No description of what changes.

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Thursday, 17-Apr-2025 22:53:56 JST Will Dormann

   in reply to

   So, apparently this is the "fix" for CVE-2025-21204. Microsoft recently updated their advisory to say what the update does.

   Prior to everybody freaking out, the advisory for CVE-2025-21204 said nothing about what it does.

   Two gripes:

   1. MSRC publishing content-free advisories has consequences, but they never seem to appreciate this.
   2. I told MSRC YEARS AGO that they can avoid an entire class of LPE vulnerabilities in 3rd-party software and their own software by not allowing non-admin users to be able to create directories off of C:\. They refused to make any change because it might "break things".

   Great job, folks.