OnlyPatch
Windows KDC Proxy Service (KPSSVC)

CVE-2025-33071 — Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability

Critical CVSS 8.1 EPSS 0.17324 🔬 Patch diffed 2025-06 archive

Executive Summary

Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.

Overview

8.1
CVSS HIGH
Critical
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Remote Code Execution
Weakness CWE-416: Use After Free
Released Jun 10 2025
Last Updated Jun 10 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.17324 — 0.96834 percentile
NVD CVSS 8.1 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.1

EPSS Score

0.17324
probability of exploitation in the next 30 days
0.96834 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

9 affected products
Product KB Article Severity Impact Restart Required
Windows Server 2012 5061059 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 (Server Core installation) 5061059 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 R2 5061018 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2012 R2 (Server Core installation) 5061018 (Monthly Rollup) Critical Remote Code Execution Yes
Windows Server 2016 5061010 (Security Update) Critical Remote Code Execution Yes
Windows Server 2016 (Server Core installation) 5061010 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 5060531 (Security Update) Critical Remote Code Execution Yes
Windows Server 2019 (Server Core installation) 5060531 (Security Update) Critical Remote Code Execution Yes
Windows Server 2022 5060526 (Security Update) 5060525 (SecurityHotpatchUpdate) Critical Remote Code Execution 5058385 5058500 Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.3807 10.0.20348.3745 Yes None Windows Server 2022 (Server Core installation) 5060526 (Security Update) 5060525 (SecurityHotpatchUpdate) Critical Remote Code Execution 5058385 5058500 Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.3807 10.0.20348.3745 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5060118 (Security Update) Critical Remote Code Execution Yes

Patches

5 patches
Article Type Restart
5061059 Monthly Rollup Yes
5061018 Monthly Rollup Yes
5061010 Security Update Yes
5060531 Security Update Yes
5060118 Security Update Yes

Patch Diff

ghidriff · kpssvc.dll (KB5060842)

Use-after-free (CWE-416, race-triggered) in the Windows KDC Proxy Service kpssvc.dll (KPSSVC, MS-KKDCP), unauthenticated remote code execution against servers configured as a KDC Proxy (Critical, AV:N, AC:H race, CVSS 8.1). Each proxied Kerberos request is tracked by a _KPS_IO context created by KpsCreateKpsIo and released by KpsFreeKpsIo, driven asynchronously through HTTP receive/send and backend-socket stages each with its own I/O completion routine (KpsHttp*IoCompletion, KpsSocket*IoCompletion) operating on the same _KPS_IO. PRE: the _KPS_IO could be freed by one path (cancel/timeout/completion) while another in-flight completion still referenced it - a race UAF. Because KPSSVC accepts KKDCP requests over the network without authentication, the freed-object reuse is an RCE primitive (Microsoft rates it Critical; domain controllers are not affected - only servers configured as KDC Proxy). Diff of kpssvc.dll 10.0.26100.3912 -> .4343 (Jun 10 2025, KB5060842, Windows Server 2025; OS fixed build .4349; vsize 274432 -> 286720) confirms the fix: a KpsIoLockedRef locked-reference wrapper is introduced (gated behind CFR flag Feature_4205429049) and threaded through the request paths - KpsProcessProxyRequest's signature changes from _KPS_IO* to KpsIoLockedRef&, so the context is held alive/serialized while in use and KpsFreeKpsIo (now paired with KpsCancelTimeoutTimer) releases it only once no locked reference remains. Stated at confirmed-changed level (broad async-lifecycle rework; the isolable mechanism is the KpsIoLockedRef reference lifetime management).

Pre-patch version 10.0.26100.3912 Download
Post-patch version 10.0.26100.4343 Download
Function Address Change Note
KpsProcessProxyRequest code change code (now takes a KpsIoLockedRef locked reference instead of a raw _KPS_IO*) Signature changed from KpsProcessProxyRequest(_KPS_IO*) to KpsProcessProxyRequest(KpsIoLockedRef&) - the request context is now held via a locked reference across processing so it cannot be freed while in use.
KpsFreeKpsIo / KpsCreateKpsIo code change code (request-context lifecycle reworked, CFR-gated) KpsFreeKpsIo now pairs with KpsCancelTimeoutTimer and releases the _KPS_IO only once no locked reference remains (Feature_4205429049); the async completion routines (Kps*IoCompletion) acquire/hold the locked reference.
Feature_4205429049 gate added (CFR gate) Dominant CFR flag gating the KpsIoLockedRef locked-reference lifecycle; the original raw-pointer _KPS_IO handling remains when the flag is disabled.
View full diff report View RCA report

Attack Path

A race between request-context teardown and an in-flight KKDCP completion frees the _KPS_IO while still in use

Attack path for CVE-2025-33071 A race between request-context teardown and an in-flight KKDCP completion frees the _KPS_IO while still in use 01 — ENTRY Unauthenticated attacker sends crafted KKDCP requests to a KDC Proxy server kpssvc processes each proxied Kerberos request via a _KPS_IO context driven through async HTTP/socket stages. AV:N / PR:N / UI:N (network, no auth). 02 — CONTROLLED INPUT Drives concurrent completion / cancellation on the same request AC:H - the attacker must win the race between a teardown (cancel/timeout/completion) and an in-flight completion that still references the _KPS_IO. 03 — MISSING CHECK _KPS_IO freed while still referenced (CWE-416) Pre-patch one path frees the request context while another in-flight completion is still using it - a use-after-free of the _KPS_IO. 04 — IMPACT Freed request context reused -> remote code execution The freed _KPS_IO is reclaimed/reused, giving an unauthenticated network attacker code execution in the KDC Proxy service (Critical).

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

Detection Rules

Acknowledgments

k0shl
ʌ!ɔ⊥ojv with Kunlun Lab

On This Page