CVE-2025-59326 in CryptoPro Secure Disk for Bitlocker
Summary
by MITRE • 08/12/2026
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from these locations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in CPSD CryptoPro Secure Disk for BitLocker versions prior to v7.7.4 represents a critical security flaw that undermines the integrity protection mechanisms designed to prevent unauthorized code execution. This issue stems from the product's failure to properly enforce Integrity Measurement Architecture (IMA) policy protections across temporary file systems, creating a persistent attack surface where malicious actors can exploit the weakened security controls. The vulnerability specifically affects systems that rely on IMA for enforcing security policies and monitoring file integrity within temporary storage areas.
The technical flaw manifests in the improper implementation of IMA policy enforcement within the temporary file system contexts used by the CryptoPro Secure Disk solution. When BitLocker encryption is implemented through this software, temporary files created during the encryption process or system operations are not adequately protected by the established integrity policies. This creates a scenario where unsigned executables can be placed in these temporary locations and subsequently executed without proper verification mechanisms. The vulnerability essentially allows for a bypass of the security controls that should normally prevent execution of untrusted code within the system's temporary storage areas.
From an operational impact perspective, this vulnerability presents significant risks to organizations relying on CryptoPro Secure Disk for BitLocker protection. Attackers can leverage this weakness to execute malicious code in temporary file systems where normal security restrictions do not apply, potentially leading to privilege escalation, data exfiltration, or system compromise. The attack vector is particularly concerning because temporary file systems are commonly used by legitimate processes and applications, making it easier for malicious code to blend in with normal system activity. This vulnerability directly impacts the integrity protection model that organizations depend on for maintaining secure computing environments.
The security implications extend beyond simple code execution, as this weakness can be exploited to circumvent broader security policies and integrity measurement frameworks. Organizations using affected versions of CryptoPro Secure Disk may experience unauthorized access to encrypted data or complete system compromise if attackers successfully leverage this vulnerability. The issue aligns with common attack patterns described in the ATT&CK framework under techniques related to privilege escalation and persistence, particularly those involving temporary file manipulation. This vulnerability also relates to CWE-15 which describes improper neutralization of special elements used in code, and CWE-276 which addresses incorrect permissions for critical resources.
Mitigation strategies should prioritize immediate upgrade to CPSD CryptoPro Secure Disk version 7.7.4 or later, which contains the necessary patches to properly enforce IMA policy protections across temporary file systems. Organizations should also implement additional monitoring of temporary file system activity and consider implementing additional integrity measurement controls beyond what is provided by the patched software. Security teams should conduct thorough assessments of their current temporary file system configurations to identify any other potential bypasses or weaknesses in their security architecture. Regular vulnerability scanning and security audits should be implemented to detect similar issues in other security tools that may not properly enforce integrity policies across all system contexts, including temporary storage areas where sensitive operations occur.