CVE-2025-59199Disclosure(microsoft / windows_10_1809)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch microsoft windows_10_1809 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59199

Weakness type (CWE)

CWE-284

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_22h2

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 8 signals
Disclosure: 6 classified signals
Peaked 5d ago at 2 mentions (2026-05-28); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

microsoft

Products

windows_10_1809windows_10_21h2windows_10_22h2windows_11_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_server_2019windows_server_2022windows_server_2022_23h2

Deep dive

Activity timeline8 mentions / 6d

Signal classification3 categories

Disclosure

675.0%

Patch

112.5%

PoC

112.5%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	2	Disclosure2
2026-06-01	2	Disclosure1Patch1
2026-06-02	1	Disclosure1
2026-06-03	1	Disclosure1
2026-06-08	1	PoC1
2026-06-12	1	Disclosure1

Full discourse8 posts

Or Yair@oryair1999132d
Disclosure
Fresh @safebreach Labs research! 🔥 CVE-2025-59199 breaks down a highly creative low-integrity Windows LPE path. Learn how Notifications, COM objects, URIs, DevTools, and Windows Apps chain together in a single exploit. Great work team! 👇 https://www.safebreach.com/blog/click-or-trick-cve-2025-59199-escaping-the-sandbox-with-windows-uris/
Post summary
The post announces research on CVE‑2025‑59199, describing a low‑integrity Windows local privilege escalation path that chains notifications, COM objects, URIs, DevTools, and Windows apps.
117043253.5K
877 followersView on X
SafeBreach@safebreach137d
Disclosure
New Research: Click Or Trick (CVE-2025-59199): How do you escape the Windows 11 sandbox? SafeBreach Labs uncovered that all it takes is a single user click and chaining 4 unrelated subsystems: COM, App Identity, URI quirks, and DevTools WebSockets. 🔗https://hubs.ly/Q04jc0hZ0 https://t.co/OLwp09aePq
Post summary
SafeBreach Labs has uncovered that the CVE-2025-59199 sandbox escape can be achieved with a single user click by chaining COM, App Identity, URI quirks, and DevTools WebSockets, and the full research is linked in the tweet.
0902071.3K
2.5K followersView on X
Mr. OS@ksg93rd131d
Disclosure
#AppSec #Threat_Research 1⃣. Click Or Trick (CVE-2025-59199): Escaping the Sandbox with Windows URIs https://www.safebreach.com/blog/click-or-trick-cve-2025-59199-escaping-the-sandbox-with-windows-uris 2⃣. Adobe Acrobat Reader Escript.api UAF RCE https://blog.exodusintel.com/2026/06/01/adobe-acrobat-reader-escript-api-use-after-free-remote-code-execution 3⃣. Exploiting Windows Defender's Remediation Workflow for LPE https://blog.calif.io/p/redsun-exploiting-windows-defenders
Post summary
The post lists three disclosed vulnerabilities with blog links, offering technical details but no proof‑of‑concept code, active exploitation evidence, or patches.
01056507
3.3K followersView on X
GudiniMalware@gudinimalware126d
PoC
Click Or Trick (CVE-2025-59199): Escaping the Sandbox with Windows URIs #cybersec #infosec https://www.safebreach.com/blog/click-or-trick-cve-2025-59199-escaping-the-sandbox-with-windows-uris/
Post summary
The post announces CVE-2025-59199, a Windows sandbox escape via URIs, and presents a PoC demonstrating the technique.
0001155
5 followersView on X
Rushikesh Khaire@Rushikesh6824122d
Disclosure
#AppSec #Threat_Research 1⃣ Click Or Trick (CVE-2025-59199): Escaping the Sandbox with Windows URIs https://www.safebreach.com/blog/click-or-trick-cve-2025-59199-escaping-the-sandbox-with-windows-uris 2⃣ Adobe Acrobat Reader Escript.api UAF RCE https://blog.exodusintel.com/2026/06/01/adobe-acrobat-reader-escript-api-use-after-free-remote-code-execution 3⃣ Exploiting Windows Defender's Remediation Workflow for LPE https://blog.calif.io/p/redsun-exploiting-windows-defenders
Post summary
The post announces three new CVEs, providing titles and links to detailed blog posts that outline the basic nature of each vulnerability, but it lacks explicit PoCs, exploits, or active exploitation evidence.
0001065
5 followersView on X
WindowsForum@windowsforum132d
Disclosure
🚨 Windows 11 Sandbox Escape via “toast click” (CVE-2025-59199) = Microsoft’s idea of a safe playground… with a hidden trapdoor. “Guided tour” for attackers, not users. https://windowsforum.com/threads/windows-11-sandbox-escape-cve-2025-59199-toast-click-to-teams-debug-chain.421347/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #SandboxEscape #EndpointDetection #Windows11Security #Cve202559199 https://t.co/yXPNEbxneN
Post summary
A new Windows 11 sandbox escape vulnerability (CVE‑2025‑59199) triggered by a toast click has been disclosed, with a forum thread linked for further details.
0001055
1.1K followersView on X
WindowsForum@windowsforum133d
Patch
🪟 “Click or Trick” sandbox escape (CVE-2025-59199) fixed after one-click low-to-high jump. So yeah, Windows is the attack surface again—no driver magic required. Love that for us. #Windows #Microsoft #Security https://windowsforum.com/threads/windows-11-click-or-trick-cve-2025-59199-sandbox-escape-toast-to-teams-debug-port.421329/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #SandboxEscape #Windows11Security https://t.co/HxIzgllR1v
Post summary
CVE‑2025‑59199 is a Windows 11 sandbox escape that has already been patched with a one‑click low‑to‑high jump fix; no active exploitation is reported.
0000046
1.1K followersView on X
Autumn Good@autumn_good_35137d
Disclosure
『What makes this research unusual is that it crosses four security domains that rarely appear in the same research, let alone the same exploit.』🧐 Click Or Trick (CVE-2025-59199): Escaping the Sandbox with Windows URIs https://www.safebreach.com/blog/click-or-trick-cve-2025-59199-escaping-the-sandbox-with-windows-uris/
Post summary
The cited blog post announces a sandbox‑escape vulnerability (CVE-2025-59199) that manipulates Windows URIs, but it does not provide PoC code, patch information, or evidence of active exploitation in the text.
00000425
6.9K followersView on X

CPE platform detail11 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

11 of 11 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1809	-	-	-
OS	microsoft	windows_10_21h2	-	-	-
OS	microsoft	windows_10_22h2	-	-	-
OS	microsoft	windows_11_22h2	-	-	-
OS	microsoft	windows_11_23h2	-	-	-
OS	microsoft	windows_11_24h2	-	-	-
OS	microsoft	windows_11_25h2	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2022_23h2	-	-	-
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_10_1809 vulnerabilities

What researchers are saying

CVE-2025-59199

WindowsForum[verified]@windowsforumDisclosure

A new Windows 11 sandbox escape vulnerability (CVE‑2025‑59199) triggered by a toast click has been disclosed, with a forum thread linked for further details.

WindowsForum[verified]@windowsforumPatch

CVE‑2025‑59199 is a Windows 11 sandbox escape that has already been patched with a one‑click low‑to‑high jump fix; no active exploitation is reported.

Or Yair@oryair1999Disclosure

The post announces research on CVE‑2025‑59199, describing a low‑integrity Windows local privilege escalation path that chains notifications, COM objects, URIs, DevTools, and Windows apps.

SafeBreach@safebreachDisclosure

SafeBreach Labs has uncovered that the CVE-2025-59199 sandbox escape can be achieved with a single user click by chaining COM, App Identity, URI quirks, and DevTools WebSockets, and the full research is linked in the tweet.

Mr. OS@ksg93rdDisclosure

The post lists three disclosed vulnerabilities with blog links, offering technical details but no proof‑of‑concept code, active exploitation evidence, or patches.

GudiniMalware@gudinimalwarePoC

The post announces CVE-2025-59199, a Windows sandbox escape via URIs, and presents a PoC demonstrating the technique.

Rushikesh Khaire@Rushikesh6824Disclosure

The post announces three new CVEs, providing titles and links to detailed blog posts that outline the basic nature of each vulnerability, but it lacks explicit PoCs, exploits, or active exploitation evidence.

Autumn Good@autumn_good_35Disclosure

The cited blog post announces a sandbox‑escape vulnerability (CVE-2025-59199) that manipulates Windows URIs, but it does not provide PoC code, patch information, or evidence of active exploitation in the text.