OnlyPatch
Windows SSDP Service

CVE-2025-59196 — Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00243 🔬 Patch diffed 2025-10 archive

Executive Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Released Oct 14 2025
Last Updated Oct 14 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00243 — 0.15636 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00243
probability of exploitation in the next 30 days
0.15636 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

33 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5066837 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5066837 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5066836 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5066836 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5066586 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5066586 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5066872 (Monthly Rollup) 5066876 (Security Only) Important Elevation of Privilege 5065468 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27974 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5066872 (Monthly Rollup) 5066876 (Security Only) Important Elevation of Privilege 5065468 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27974 Yes None Windows Server 2012 5066875 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5066875 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5066873 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5066873 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5066836 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5066836 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5066586 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5066586 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5066782 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5066782 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5066780 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5066835 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5066835 (Security Update) Important Elevation of Privilege Yes

Patches

10 patches
Article Type Restart
5066837 Security Update Yes
5066836 Security Update Yes
5066586 Security Update Yes
5066791 Security Update Yes
5066793 Security Update Yes
5066835 Security Update Yes
5066875 Monthly Rollup Yes
5066873 Monthly Rollup Yes
5066782 Security Update Yes
5066780 Security Update Yes

Patch Diff

ghidriff · ssdpsrv.dll (KB5066835)

Race condition (CWE-362) leading to use-after-free (CWE-416) in the Windows SSDP Discovery Service ssdpsrv.dll, local elevation of privilege to SYSTEM (Important, AV:L, AC:H race, CVSS 7.0). CSsdpNotifyRequestManager tracks per-client notification semaphores in a list; _WakeupGetNotificationRpc signals a client's semaphore (ReleaseSemaphore) when a notification is ready, and semaphores are removed on teardown via HrRemoveNotifySemaphoreFromList (reached through _RemoveSyncHandle). PRE: these paths were not adequately synchronized, so _WakeupGetNotificationRpc could signal a notify semaphore while another thread removed and freed that same semaphore from the list - a race yielding a use-after-free. Because the SSDP service runs at higher privilege than the caller, winning the race elevates a local attacker to SYSTEM. Diff of ssdpsrv.dll 10.0.26100.6725 (KB5065789, Sept) -> .6899 (KB5066835, Oct 14 2025, 24H2) confirms the fix: gated behind CFR flag Feature_3942159674, the manager consolidates semaphore handling into a single synchronized method - HrRemoveNotifySemaphoreFromList is reworked into HrOperateNotifySemaphoreFromList(sem, _Semaphore_OPERATION) that performs the semaphore release/remove atomically under the manager's list synchronization; _WakeupGetNotificationRpc and _RemoveSyncHandle route through it instead of releasing/removing independently, so signal and free can no longer race on the same notify semaphore.

Pre-patch version 10.0.26100.6725 Download
Post-patch version 10.0.26100.6899 Download
Function Address Change Note
CSsdpNotifyRequestManager::HrRemoveNotifySemaphoreFromList -> HrOperateNotifySemaphoreFromList code change code (consolidated into a synchronized semaphore-operation method, CFR-gated) Reworked from HrRemoveNotifySemaphoreFromList(void*) to HrOperateNotifySemaphoreFromList(void*, _Semaphore_OPERATION); performs the semaphore release/remove atomically under the manager's list synchronization (Feature_3942159674).
_WakeupGetNotificationRpc code change code (routes semaphore signal through the synchronized method) Pre: called ReleaseSemaphore(sem, 1, ...) directly while the semaphore could be removed/freed on another path. Post (Feature_3942159674): calls HrOperateNotifySemaphoreFromList so the signal is serialized with list membership.
_RemoveSyncHandle code change code (routes removal through the synchronized method) Now calls HrOperateNotifySemaphoreFromList instead of HrRemoveNotifySemaphoreFromList directly, serializing removal with the wakeup/signal path.
Feature_3942159674 gate added (CFR gate) CFR flag gating the consolidated synchronized notify-semaphore operation; the original independent release/remove paths still ship when disabled.
View full diff report View RCA report

Attack Path

A race between SSDP notification wakeup and notify-semaphore removal frees a semaphore still in use

Attack path for CVE-2025-59196 A race between SSDP notification wakeup and notify-semaphore removal frees a semaphore still in use 01 — ENTRY Local attacker drives SSDP notification register/wait/teardown ssdpsrv (SSDP Discovery service) manages per-client notify semaphores via CSsdpNotifyRequestManager. AV:L / PR:L. 02 — CONTROLLED INPUT Wins a race between wakeup-signal and removal AC:H - the attacker triggers _WakeupGetNotificationRpc (ReleaseSemaphore) concurrently with removal/teardown of the same notify semaphore. 03 — MISSING CHECK Notify semaphore freed while being signalled (CWE-362 -> CWE-416) Pre-patch the signal and remove/free run on unsynchronized paths, so the semaphore is used after being removed and freed from the list. 04 — IMPACT Use-after-free -> SYSTEM Reuse of the freed notify-semaphore object in the higher-privileged SSDP service is exploitable for local elevation of privilege to SYSTEM.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

Detection Rules

Acknowledgments

k0shl

On This Page