CVE-2026-33825

A TOCTOU race condition in the Microsoft Defender Antimalware Platform update orchestrator allows a local low-privileged user to write an arbitrary file as SYSTEM via a symbolic-link hijack of the platform update staging directory. Proof-of-concept code was published to GitHub prior to Microsoft's advisory. No in-the-wild exploitation confirmed at release time, but the bug is trivial to weaponize and expected to appear in commodity post-exploitation toolkits within days.

CVSS v3 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-367, CWE-59

Threats tracking this CVE

• Microsoft April 2026 Patch Tuesday — 167 Flaws, 2 Zero-Days (SharePoint Spoofing CVE-2026-32201 + Defender EoP CVE-2026-33825) — CRITICAL

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825

Markdown version · Threadlinqs Intelligence