CVE-2025-60710 PoC — Host Process for Windows Tasks Elevation of Privilege Vulnerability

Source

https://github.com/redpack-kr/CVE-2025-60710

Associated Vulnerability

Title: Host Process for Windows Tasks Elevation of Privilege Vulnerability (CVE-2025-60710)
Description:Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

Readme

# CVE-2025-60710

This is PoC for local privilege escalation vulnerability in `\Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration` scheduled task.

When this scheduled task is started the taskhostw.exe process whill try to open the `C:\Users\%username%\AppData\Local\CoreAIPlatform.00\UKP` directory and search for directories using the following filter: `{????????-????-????-????-????????????}`. If that directory is found it will be deleted without checking for symbolic links.

As low privilege user by default can create directories in their own %LOCALAPPDATA% folder this leads to arbitrary folder delete in context of `NT AUTHORITY\SYSTEM` user.

The scheduled task is configured with multiple triggers that can be used to start the scheduled task.

```
  <Triggers>
    <WnfStateChangeTrigger id="RecallPolicyCheckUpdateTrigger">
      <Enabled>true</Enabled>
      <StateName>7508BCA32C079E41</StateName>
    </WnfStateChangeTrigger>
    <WnfStateChangeTrigger id="AADStatusChangeTrigger">
      <Enabled>true</Enabled>
      <StateName>7508BCA32C0F8241</StateName>
    </WnfStateChangeTrigger>
    <WnfStateChangeTrigger id="DisableAIDataAnalysisTrigger">
      <Enabled>true</Enabled>
      <StateName>7528BCA32C079E41</StateName>
    </WnfStateChangeTrigger>
    <WnfStateChangeTrigger id="UserLoginTrigger">
      <Enabled>true</Enabled>
      <StateName>7510BCA338038113</StateName>
    </WnfStateChangeTrigger>
    <SessionStateChangeTrigger id="SessionUnlockTrigger">
      <Enabled>true</Enabled>
      <StateChange>SessionUnlock</StateChange>
    </SessionStateChangeTrigger>
  </Triggers>
  ```

This PoC utilise the WnfStateChangeTrigger `RecallPolicyCheckUpdateTrigger` to start the scheduled task.

## PoC

<img width="1897" height="952" alt="image" src="https://github.com/user-attachments/assets/a4a9c9d6-80b3-4dad-ae41-71e328c7ebcb" />

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →