CVE-2025-68623 affects the Microsoft DirectX End-User Runtime Web Installer version 9.29.1974.0. The core issue lies in the installer’s process of downloading executables and DLLs to the %TEMP% directory, which is writable by any standard user. The installer runs with HIGH integrity privileges, meaning it has elevated permissions during installation. After downloading, the installer executes the downloaded executable to complete the installation. Because the %TEMP% folder is writable by low-privilege users, an attacker can replace the legitimate executable with a malicious payload before execution. When the installer runs this malicious executable with HIGH integrity, the attacker’s code gains elevated privileges. This can lead to a complete privilege escalation chain from a standard user to SYSTEM level, as code running at HIGH integrity can register and execute Windows services, which run with SYSTEM privileges. Although the supplier disputes this as a vulnerability, asserting this behavior is by design, the security implications remain significant. No patch or mitigation has been officially provided, and no known exploits have been reported in the wild. The vulnerability was published on March 11, 2026, and no CVSS score has been assigned.

The vulnerability allows a low-privilege user on a system to escalate their privileges to SYSTEM level, which is the highest level of privilege on a Windows system. This can lead to full system compromise, allowing attackers to install persistent malware, manipulate system configurations, steal sensitive data, or disrupt system availability. Organizations using the affected DirectX installer version are at risk if untrusted users have local access to the system. The attack requires local access but does not require user interaction beyond the installation process. This vulnerability could be exploited in multi-user environments, shared workstations, or scenarios where untrusted users have limited access. The lack of authentication or complex exploitation steps increases the risk. Although no known exploits are reported, the potential impact on confidentiality, integrity, and availability is critical if exploited.

To mitigate this vulnerability, organizations should restrict write permissions to the %TEMP% directory during installation processes to prevent unauthorized file replacement. Running installers in isolated environments or with restricted user permissions can reduce risk. Administrators should monitor and control local user access rights to prevent untrusted users from executing installers or modifying temporary files. Employ application whitelisting to ensure only trusted executables run with elevated privileges. Consider using alternative installation methods that do not rely on downloading executables to writable directories or that validate the integrity of downloaded files before execution. Until an official patch or update is released, avoid running the affected installer version on systems where untrusted users have local access. Additionally, implement endpoint detection and response (EDR) solutions to detect suspicious service registration or execution activities indicative of privilege escalation attempts.