# CVE-2025-58727 — Windows Connected Devices Platform Service `cdpsvc.dll` App-Target Result Race → Elevation of Privilege

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cdpsvc.dll` (Connected Devices Platform Service / CDPSvc) |
| **CVE ID** | CVE-2025-58727 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.0 / 6.1 — `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| **Delivery** | Local — win a race on the CDP device-query result path |
| **KB / Fixed build** | KB5066835 — `cdpsvc.dll` 10.0.26100.6899 (Win11 24H2 x64) |
| **Patch Date** | October 14, 2025 (2025-Oct) |
| **Pre-patch binary** | `cdpsvc.dll` 10.0.26100.6725 (KB5065789) — SHA256 `878f35b1cafe6a27d6220da0df7f2c150ab7c745a70fbb5f4adbbdc652aa9a4a` |
| **Post-patch binary** | `cdpsvc.dll` 10.0.26100.6899 (KB5066835) — SHA256 `d8ae079b813694f5683addf96a61e015a395ef2c6ec16ff7f91dcc221624069a` |
| **Feature flag** | `Feature_1319939386` / `Feature_Servicing_CDPComDeviceQuery` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`cdpsvc.dll` implements the **Connected Devices Platform Service** (CDPSvc), which
brokers cross-device connectivity and app-target discovery. `CDPComDevice` issues
device queries and receives their results asynchronously; `DeviceCallback::OnAppTargetListReceived`
is the callback invoked when a device's **app-target list** query result
(`CDPComDeviceResult`) arrives, and it resolves app identities
(`ComAppIdFromCDPAppId`) from that shared result.

---

## Vulnerability Summary

`OnAppTargetListReceived` processed the CDP device-query result — shared state produced
by the device-query machinery — **without adequate synchronization** against concurrent
query/teardown operations. A racing operation on that shared query state could
therefore run alongside the callback (CWE-362), corrupting or using stale/invalid state.
Because CDPSvc is a service reachable by a local user and the race lets an attacker
influence privileged processing, winning the race (`AC:H`) allows elevation to **SYSTEM**
(per the MSRC FAQ).

> Confirmation level: this October update restructures the result-handling path under
> `Feature_1319939386` / `Feature_Servicing_CDPComDeviceQuery` (the changed function
> `OnAppTargetListReceived`, ratio 0.65, plus 7 added helpers). The isolable mechanism
> is that the result processing is moved into a **gated `std::function`/lambda dispatch**
> so the shared CDP query state is handled on a serialized path rather than inline; an
> explicit single lock primitive is not cleanly isolable, so this is stated at
> confirmed-changed level per the CWE-362 classification and the observed restructure.

---

## Prerequisites and Constraints

- Local, low-privileged (`AV:L`, `PR:L`); `AC:H` — must win a race between the CDP
  app-target result callback and a concurrent device-query/teardown operation.
- Result: the shared CDP device-query state is accessed concurrently / while stale.

---

## Vulnerability Details

### Root Cause

The async app-target result callback accessed shared CDP device-query state without
serializing against concurrent query operations, so the state could be raced.

### The patch (confirmed — diff, .6725 → .6899)

Gated behind `Feature_1319939386` / `Feature_Servicing_CDPComDeviceQuery`,
`OnAppTargetListReceived` is reworked so the result processing is **dispatched through a
new gated `std::function`/lambda** instead of the prior inline `_Func_impl` handler:

```c
// CDPComDevice::DeviceCallback::OnAppTargetListReceived (10.0.26100.6899) — PATCHED (from the diff)
// pre: built an inline std::_Func_impl_no_alloc<lambda_dde3f900...> and invoked it directly
// post:
lambda_7ffd2521(local_68, &appId, resultStr, &ctx);                 // new closure over the query result
puVar1 = std::function<long(CDPComDeviceResult&)>::function(local_50, local_68);
... invoke(puVar1) ...                                               // dispatched via the gated path

// <lambda_7ffd2521>::operator() (added) — gated:
if (Feature_1319939386__private_IsEnabled()) {
    appId = ComAppIdFromCDPAppId(result->appId, ...);               // result processed on the serialized path
    ...
}
```

By routing the app-target result through the `Feature_1319939386` /
`Feature_Servicing_CDPComDeviceQuery`-gated dispatch, the shared CDP device-query state
is handled on a controlled/serialized path rather than raced inline, closing the race
condition.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1319939386` / `Feature_Servicing_CDPComDeviceQuery`.** The
reworked result-handling runs only when the flags are enabled; the original inline path
still ships when disabled. Verify the flags are enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Use-after-free / state-corruption crashes in the Connected Devices
Platform Service (`cdpsvc!CDPComDevice::DeviceCallback::OnAppTargetListReceived`) on
unpatched/flag-disabled builds, correlated with concurrent CDP device-query activity
from local processes.

**Config.** The fix is CFR-gated — confirm `Feature_1319939386` /
`Feature_Servicing_CDPComDeviceQuery` are enabled.

---

## References

- MSRC advisory — CVE-2025-58727 (Windows Connected Devices Platform Service Elevation of Privilege), released 2025-10-14, KB5066835.
- Full binary diff: `/data/patch_diffs/cdpsvc_dll-cve-2025-58727-ghidriff.md`