DLL Hijacking Vulnerability in Windows 11 for ARM64 by Microsoft

CVE-2025-7676

What is CVE-2025-7676?

This vulnerability allows attackers to exploit DLL hijacking in all PE32 executables running on the Windows 11 ARM64 architecture. By placing a malicious DLL in the same directory as the vulnerable executable, an attacker can execute arbitrary code when the executable is launched. This issue arises because vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would not typically be sourced from the application directory, presenting an opportunity for exploitation. Users are advised to upgrade to release 24H2, which addresses this security concern.

References