CVE-2025-12683 — NULL DACL assigned to Named Pipe communicating with SYSTEM Service
The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides a…
Published: 2025-11-04 · CVSS: 5.8 · CVSS 4.0
The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalation(only if chained with other elements) for a local low privilege user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7