CVE-2025-7676
Medium
Description
DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs.
SeverityMedium
CVSS5.4
Exploit probability—
ProductWindows 11
PublishedJul 28, 2025
First seenJul 28, 2025
Weakness typeCWE-427CWE-427
How to fix
Update
- Microsoft, Inc Windows 1124H2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft, Inc Windows 11 | v < 24H2 | 24H2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.