# CVE-2025-26633 — Microsoft Management Console `mmc.exe` Untrusted-Source Check Skipped on MUI/Localized `.msc` Path ("EvilTwin" Security-Feature Bypass)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `mmc.exe` (Microsoft Management Console) |
| **CVE ID** | CVE-2025-26633 |
| **Impact** | Security Feature Bypass → code execution (MMC console/`.msc` trust bypass) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.5 — `CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` |
| **CWE** | CWE-707: Improper Neutralization |
| **Exploited in the wild** | **Yes** (Exploitation Detected) — the "MSC EvilTwin" technique |
| **Delivery** | Local — user opens a specially crafted `.msc` (email/web enticement) |
| **KB / Fixed build** | KB5053598 — `mmc.exe` 10.0.26100.3476 (Win11 24H2 x64) |
| **Patch Date** | March 11, 2025 (2025-Mar) |
| **Pre-patch binary** | `mmc.exe` 10.0.26100.3323 — SHA256 `b2e26222c500fb444800edc84d4f39468ce3b8b647284eadb316cb0d5f04bb90` |
| **Post-patch binary** | `mmc.exe` 10.0.26100.3476 — SHA256 `2c0bbd41ae2523a5af6c6c3e7d95ac16b22e2ac26ec884e6282fff97afc48c8c` |
| **Feature flag** | `Feature_220736827` — **the fix is CFR-gated** (adds the check on the MUI path) |

---

## Product Description

`mmc.exe` is the **Microsoft Management Console**, which opens saved console files
(`.msc`). `CAMCDoc::ScOnOpenDocument` handles opening a `.msc`; it resolves the file
to load — including a **localized/MUI variant** via `ScGetMuiPath` — and, for
untrusted sources, is meant to refuse the silent open. `_IsFileSourceUntrustworthy`
determines whether a path's source is untrusted by consulting the URL security-zone
manager (`URLMON!CoInternetCreateSecurityManager`).

---

## Vulnerability Summary

When opening a `.msc`, MMC resolves a **localized (MUI) copy** of the console file
through `ScGetMuiPath`. Pre-patch, `ScOnOpenDocument` applied the
`_IsFileSourceUntrustworthy` zone/trust check to the **primary** path only, **not to
the MUI-resolved path**. An attacker could therefore stage an **"evil twin"** — a
benign-looking primary `.msc` alongside a malicious localized `.msc` in the MUI
location — so that MMC loaded the attacker's localized console **without the
untrusted-source check firing**, bypassing the security feature (CWE-707 improper
neutralization). This is the in-the-wild **MSC EvilTwin** technique (`E:F`,
Exploitation Detected). Exploitation requires enticing the victim to open the crafted
file (`AV:L`, `UI:R`, `AC:H` — the attacker must stage the paired files first).

---

## Prerequisites and Constraints

- Local with user interaction (`AV:L`, `PR:N`, `UI:R`): the victim opens a crafted
  `.msc` (delivered by email/web enticement).
- `AC:H`: the attacker must first stage the paired primary + malicious MUI/localized
  `.msc` so MUI resolution loads the evil twin.
- Result (pre-patch): the malicious localized console is opened without the
  untrusted-source check.

---

## Vulnerability Details

### Root Cause

The untrusted-source (security-zone) check `_IsFileSourceUntrustworthy` was not
applied to the MUI/localized path returned by `ScGetMuiPath`, so a console file loaded
via MUI resolution bypassed the trust gate that the primary path enforced.

### The patch (confirmed — diff, .3323 → .3476)

The body of `_IsFileSourceUntrustworthy` is unchanged (it still zone-checks a path via
`CoInternetCreateSecurityManager`); what changes is **where it is called**. Its
reference count rises from **2 → 4**: gated behind the new flag `Feature_220736827`,
`ScOnOpenDocument` now runs the untrusted-source check on the **MUI-resolved path**
(and the additional open paths), and routes to `ScFromMMC` (failure) when the source
is untrusted:

```c
// CAMCDoc::ScOnOpenDocument (10.0.26100.3476) — PATCHED (from the diff)
... ScGetMuiPath(this, &local_b8, in_R8);          // resolve localized/MUI .msc  (local_90)
if (Feature_220736827__private_IsEnabled()) {
    // primary path:
    if (Feature_2408386874__private_IsEnabled()
            && _IsFileSourceUntrustworthy(in_R8)) {
        pSVar6 = ScFromMMC(&local_b8);              // block untrusted primary source
    }
    // *** NEW: the MUI-resolved path is now trust-checked too ***
    if (!Feature_220736827__private_IsEnabled()
            || !_IsFileSourceUntrustworthy(local_90)) {
        ...                                         // proceed only if MUI source is trusted
    }
    pSVar6 = ScFromMMC(&local_b8);                  // otherwise block
    // ShowIncompatibleFileMessage(...) / ScGetFileProperties(...) on the reject path
}
```

Pre-patch, only the primary path was passed to `_IsFileSourceUntrustworthy`; the
MUI-resolved `.msc` was opened without that check. With the added check on the MUI
path (under `Feature_220736827`), an untrusted localized console is now rejected via
`ScFromMMC`, closing the EvilTwin bypass.

### Patch Completeness Assessment

**CFR-gated behind `Feature_220736827`.** The added MUI-path trust check runs only when
the flag is enabled; the pre-patch behaviour (check applied to the primary path only,
under `Feature_2408386874`) remains when disabled. Given active in-the-wild
exploitation, apply KB5053598 or later and confirm `Feature_220736827` is enabled.

---

## Detection Guidance

**Behavioural.** `mmc.exe` opening `.msc` consoles from untrusted locations
(Downloads, `%TEMP%`, `INetCache`, network) — especially the presence of a **localized
`.msc` under an MUI/`<lang>` subdirectory** paired with a benign primary console (the
EvilTwin layout); child processes spawned from `mmc.exe` after opening such a file.
Treat `.msc` files from email/web as dangerous. This CVE was exploited in the wild
(reported "MSC EvilTwin" / MSC-file abuse); hunt retrospectively.

**Config.** The fix is CFR-gated — confirm `Feature_220736827` is enabled.

---

## References

- MSRC advisory — CVE-2025-26633 (Microsoft Management Console Security Feature Bypass), released 2025-03-11, KB5053598. Exploitation Detected.
- Full binary diff: `/data/patch_diffs/mmc_exe-cve-2025-26633-ghidriff.md`