How severe is CVE-2025-4525?

CVE-2025-4525 has a CVSS 3.x base score of 7.0, rated high severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-4525 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-4525?

CVE-2025-4525 affects Discord. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-4525?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-4525 have an EU (EUVD) identifier?

Yes. CVE-2025-4525 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14248.

When was CVE-2025-4525 published?

CVE-2025-4525 was published on 2025-05-10 and last updated on 2026-06-17.

CVE-2025-4525

CVE-2025-4525 is a high-severity vulnerability in Discord with a CVSS 3.x base score of 7.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-426.

Key facts

Severity: High (CVSS 3.x base score 7.0)
CVSS v2: 6.0
CVSS v4: 7.3
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-14248
Weakness: CWE-426
Affected product: Discord
Published: 2025-05-10
Last modified: 2026-06-17

Description

A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Frequently asked questions

What is CVE-2025-4525?: A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
How severe is CVE-2025-4525?: CVE-2025-4525 has a CVSS 3.x base score of 7.0, rated high severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-4525 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-4525?: CVE-2025-4525 affects Discord. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-4525?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-4525 have an EU (EUVD) identifier?: Yes. CVE-2025-4525 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14248.
When was CVE-2025-4525 published?: CVE-2025-4525 was published on 2025-05-10 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:discord:discord:1.0.9188:*:*:*:*:*:*:*

More vulnerabilities in Discord

CVE-2024-23739 — Critical (CVSS 9.8): An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the…

All CVEs affecting Discord →

Other CWE-426 (Untrusted Search Path) vulnerabilities

CVE-2026-45772 — Critical (CVSS 9.8): Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14,…
CVE-2025-26155 — Critical (CVSS 9.8): NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path…
CVE-2024-53866 — Critical (CVSS 9.8): The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one…
CVE-2024-38462 — Critical (CVSS 9.8): iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the…
CVE-2023-30330 — Critical (CVSS 9.8): SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function…
CVE-2022-24826 — Critical (CVSS 9.8): On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and…

Browse all CWE-426 (Untrusted Search Path) vulnerabilities →