External risk intelligence

CPSD CryptoPro Secure Disk Policy Bypass via Temporary File Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-59326

The vulnerability affects disk encryption software (CryptoPro Secure Disk for Bitlocker) and its handling of temporary file systems. This is a local system-level security mechanism that operates on the host's storage. It is not designed to be network-accessible or internet-facing in normal deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in CryptoPro Secure Disk for Bitlocker that could allow unauthorized code execution from temporary file systems. The issue stems from an insufficient enforcement of security policies, potentially impacting the integrity and confidentiality of data if exploited. The main concern at this stage is confirming whether this specific technology is in use within our environment.

Unsigned code may run on temporary disk areas.
Confirm if this disk encryption software is used.
Understand potential impacts of policy bypass.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into loading unsigned code onto temporary file systems managed by the affected software. This could then lead to the execution of arbitrary code, potentially compromising the confidentiality, integrity, and availability of the system.

No privileges or user interaction needed.
Unsigned code on temporary file systems.
Arbitrary code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unsigned code execution could occur on temporary file systems due to a failure to enforce IMA policy protections. This could potentially impact the confidentiality and integrity of the system by allowing unauthorized code to run.

System integrity and data confidentiality.
Unsigned code executed on temporary file systems.
Unauthorized code execution and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in CryptoPro Secure Disk for Bitlocker, impacting temporary file system protections, is most likely owned by the infrastructure or platform team responsible for managing endpoint security and disk encryption. The immediate first step is to identify all instances of the affected software, confirm its reachability and criticality, and then determine the accountable owner to plan a risk-based remediation strategy.

Infrastructure or platform teams own the issue.
Verify affected systems and their criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CPSD CryptoPro Secure Disk for Bitlocker?

It is a specialized security tool that enhances Bitlocker's native capabilities. Organizations use it to enforce stringent integrity and encryption policies across their storage environments, ensuring that disks remain secure even when handled in complex computing setups.

What is the vulnerability in CVE-2025-59326?

This flaw is classified under CWE-693, which concerns protection mechanism failures. Specifically, the software fails to properly extend its integrity measurement policies to temporary file systems. This weakness allows the system to inadvertently permit the execution of unsigned code that should have been blocked.

How does an attacker trigger this flaw?

An attacker must place unsigned code into a temporary file system managed by the software. Simply having the software installed does not trigger the vulnerability; the bug only becomes actionable if unsigned, unauthorized code is introduced to these unprotected temporary areas and subsequently executed.

Is my system at risk if it is not internet-facing?

According to Halo Surface Signal, this software operates as a local system-level mechanism for storage protection and is generally not designed for network or internet accessibility. While the CVSS base score assumes network-based conditions, the actual deployment context often limits this risk to local interactions.

What should I do if I use this software?

Your priority is to verify if your environment runs versions earlier than 7.7.4. Coordinate with your infrastructure or platform teams to conduct an inventory of all instances. Once identified, treat this as a high-priority update to ensure policy protections are correctly enforced across all system storage areas.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.