High severity7.4NVD Advisory· Published Sep 8, 2025· Updated Apr 15, 2026
CVE-2025-59033
CVE-2025-59033
Description
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rulesnvd
- learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integritynvd
- x.com/JonnyJohnson_/status/1895103112924307727nvd
News mentions
0No linked articles in our index yet.