# CVE-2025-54103 — Windows Management Service `windows.management.service.dll` Autopilot Async Property-Config Object Lifetime Race → Use-After-Free

---

## Summary

| | |
|---|---|
| **Product** | Windows — `windows.management.service.dll` (Windows Management Service / Modern Deployment · Autopilot, runs as SYSTEM) |
| **CVE ID** | CVE-2025-54103 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.4 / 6.4 — `CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free (race-triggered) |
| **Delivery** | Local — win a race against an async property-configuration operation |
| **KB / Fixed build** | KB5065426 — `windows.management.service.dll` 10.0.26100.6584 (Win11 24H2 / Server 2025, x64) |
| **Patch Date** | September 9, 2025 (2025-Sep) |
| **Pre-patch binary** | `windows.management.service.dll` 10.0.26100.5074 — SHA256 `2bb50af8651a79e17ed4ebc338e6054389d5633dfa48967589df073e9d55264c` |
| **Post-patch binary** | `windows.management.service.dll` 10.0.26100.6584 — SHA256 `b1c4cbfa686cdada31dc0bb18fe2dbef0cd960758fe42141db43ba993970df86` |
| **Feature flag** | `Feature_3628908857` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`windows.management.service.dll` implements the **Windows Management Service** (the
Modern Deployment / MDM / Autopilot management component, running as SYSTEM). Its
`ModernDeployment::Autopilot::Core::AutopilotSurfaceHubHelper` performs device-property
configuration through **asynchronous operations** — `ConfigurePropertiesAsync` and
`ApplyPropertiesAsync` — which operate on a device-management utilities object
(`com_ptr_t<IDeviceManagementUtilities>`).

---

## Vulnerability Summary

`ConfigurePropertiesAsync` / `ApplyPropertiesAsync` started an asynchronous action and
its continuation referenced the `IDeviceManagementUtilities` object. Pre-patch, the
async operation was built with `MakeAsyncHelper` / `MakeOpLambda` and the
`com_ptr_t<IDeviceManagementUtilities>` was **released when the synchronous call
returned** — before the asynchronous continuation had finished using it. A concurrent
teardown/completion could therefore free the utilities object while the async
operation still referenced it — a use-after-free (CWE-416), reached by winning the
race (`AC:H`). Because the Management Service runs as **SYSTEM** and the operation is
reachable locally, the freed-object reuse is a local elevation-of-privilege primitive
to SYSTEM (per the MSRC FAQ).

---

## Prerequisites and Constraints

- Local (`AV:L`, `PR:N`); `AC:H` — must win a race between an async property-config
  operation's continuation and the release/teardown of the utilities object.
- Result: the `IDeviceManagementUtilities` object is freed while the async operation
  still uses it.

---

## Vulnerability Details

### Root Cause

The async property-configuration operations did not keep the
`IDeviceManagementUtilities` object alive for the duration of the asynchronous work —
the owning `com_ptr` was released at synchronous scope exit, so the async continuation
could run against a freed object.

### The patch (confirmed — diff, .5074 → .6584)

Gated behind `Feature_3628908857`, both `ConfigurePropertiesAsync` and
`ApplyPropertiesAsync` are reworked from `MakeAsyncHelper` + `MakeOpLambda` (whose
lambda did not own the object — the `com_ptr_t<IDeviceManagementUtilities>` was
destructed at scope exit) to **`MakeAsyncAction` with an owning lambda** that
constructs/destructs its captured state and **holds a strong `com_ptr` reference to
the utilities object for the whole async action**:

```text
// AutopilotSurfaceHubHelper::ApplyPropertiesAsync / ConfigurePropertiesAsync (10.0.26100.6584) — PATCHED (from the diff)
- MakeAsyncHelper<IAsyncAction, ...>( MakeOpLambda<0, CNoResult, <lambda_...>>( ... ) )   // pre: non-owning
-   ~com_ptr_t<IDeviceManagementUtilities>(...)                                            //      released at scope exit
+ MakeAsyncAction<Microsoft::WRL::AsyncCausalityOptions<&...ApplyPropertiesAsync...>>(
+     <lambda_5875ca7f...>( ... ))          // *** owning lambda: ctor/dtor manage a captured strong com_ptr ***
```

The new lambda (`lambda_5875ca7f…`) has its own constructor and destructor
(`lambda::lambda` / `lambda::~lambda`), i.e. it **owns** the captured
`IDeviceManagementUtilities` reference and keeps it alive until the async action
completes, instead of the object being released when the synchronous call returned.
With the object held by a strong reference for the operation's lifetime, a concurrent
free can no longer occur mid-operation, closing the race use-after-free.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3628908857`.** The owning-lambda async lifetime runs only
when the flag is enabled; the original non-owning `MakeOpLambda` path still ships when
disabled. Verify `Feature_3628908857` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Use-after-free / heap-corruption crashes in the Windows Management
Service (`windows.management.service!ModernDeployment::Autopilot::Core::AutopilotSurfaceHubHelper::ConfigurePropertiesAsync`
/ `ApplyPropertiesAsync`) on unpatched/flag-disabled builds, particularly under
concurrent Autopilot/device-management property operations that race the utilities
object's lifetime within the SYSTEM service.

**Config.** The fix is CFR-gated — confirm `Feature_3628908857` is enabled.

---

## References

- MSRC advisory — CVE-2025-54103 (Windows Management Service Elevation of Privilege), released 2025-09-09, KB5065426.
- Full binary diff: `/data/patch_diffs/windows_management_service_dll-cve-2025-54103-ghidriff.md`