# CVE-2025-59512 — Windows CEIP `wsqmcons.exe` Registry-Symlink EoP in `UnregisterPathForCommonUpload`

## Summary
| | |
|---|---|
| **Product** | Windows — `wsqmcons.exe` (SQM / Customer Experience Improvement Program Consolidator) |
| **CVE ID** | CVE-2025-59512 |
| **Impact** | Elevation of Privilege / DoS |
| **CWE** | CWE-59: Improper Link Resolution Before File Operation (MSRC: CWE-284) |
| **Patch Date** | November 11, 2025 |
| **Pre-patch** | `wsqmcons.exe` 10.0.19041.5794 |
| **Post-patch** | `wsqmcons.exe` 10.0.19041.6575 |
| **Feature flag** | `Feature_1207474488` — **CFR-gated** |

## Vulnerability
`wsqmcons.exe` runs as **SYSTEM** via the CEIP *Consolidator* scheduled task. On startup, `UnregisterPathForCommonUpload` enumerates subkeys of `HKLM\SOFTWARE\Microsoft\SQMClient\CommonUploader\Paths` and recursively deletes them with `SHDeleteKeyW`, **without checking for registry symbolic links**. A standard user has create-subkey rights under `Paths`; as owner of a subkey they set its DACL and plant a registry symlink inside it. `SHDeleteKeyW` follows the link, so SYSTEM deletes an **arbitrary protected `HKLM` key** (PoC: `HKLM\SOFTWARE\Classes\.ai`) — EoP / DoS (CWE-59).

## The patch (confirmed — diff)
`UnregisterPathForCommonUpload` gains a `wil Feature_1207474488::__private_IsEnabled` gate that changes the open/delete so an attacker symlink under `Paths` is not followed by the SYSTEM delete. **CFR-gated** — with the flag disabled the original path still ships.

## Detection
Standard users creating subkeys / `REG_OPTION_CREATE_LINK` symlinks under `SQMClient\CommonUploader\Paths`; SYSTEM (`wsqmcons.exe`) deleting unexpected protected `HKLM` keys. Auditing on `Paths` and sensitive targets.

## References
- CVE-2025-59512 · MSRC advisory · Full diff: `/data/patch_diffs/wsqmcons_exe-cve-2025-59512-ghidriff.md`
- Related registry-symlink EoPs: CVE-2025-59514 (mskssrv), CVE-2025-59511 (wlansvc)