Embed Notice

So, apparently this is the "fix" for CVE-2025-21204. Microsoft recently updated their advisory to say what the update does.

Prior to everybody freaking out, the advisory for CVE-2025-21204 said nothing about what it does.

Two gripes:

1. MSRC publishing content-free advisories has consequences, but they never seem to appreciate this.
2. I told MSRC YEARS AGO that they can avoid an entire class of LPE vulnerabilities in 3rd-party software and their own software by not allowing non-admin users to be able to create directories off of C:\. They refused to make any change because it might "break things".

Great job, folks.