Vulnerability in Microsoft Driver Block List Affecting Windows Systems
CVE-2025-59033
9.8CRITICAL
What is CVE-2025-59033?
A vulnerability exists in Microsoft’s driver block list which is part of the Windows Defender Application Control (WDAC) policy. If hypervisor-protected code integrity (HVCI) is not enabled on a system, specific block list entries utilize only the to-be-signed (TBS) portion of the code signer certificate effectively but fail to block others when a 'FileAttribRef' qualifier is present. This issue impacts all Windows systems that do not support or enable HVCI, potentially allowing untrusted drivers to be loaded. Microsoft advises using Application Control for systems without HVCI and highlights the need for a detailed approach to custom blocklist entries for effective enforcement.