7.4
High
CVE-2025-59033 The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy
Description
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Windows 10 | 10 → latest | No fix stated |
References
- learn.microsoft.com learn.microsoft.com
- learn.microsoft.com learn.microsoft.com
- x.com x.com
Timeline
- Published
- Last modified
Other CVEs of Windows
The 829 CVEs of Windows →
CVE-2022-50238
The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended…
7.4
High
CVE-2025-9491
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
7.0
High
CVE-2022-40733
An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version…
5.0
Medium
CVE-2022-40732
An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version…
5.0
Medium