CVE-2025-59033 is a critical vulnerability in the Microsoft vulnerable driver block list implemented via Windows Defender Application Control (WDAC) policy. On Windows systems without hypervisor-protected code integrity (HVCI) enabled or supported, certain blocklist entries that include a 'FileAttribRef' qualifier fail to block vulnerable drivers. This affects Windows 10, Windows 11, and Windows Server 2016 and later systems lacking HVCI. The vendor notes that the blocklist is intended for use with HVCI, and systems without HVCI should use App Control with a granular blocklist approach.