CVE-2025-60703CWE-822

Windows Remote Desktop Services Elevation of Privilege Vulnerability

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

⚡ An untrusted pointer dereference in Windows Remote Desktop lets a savvy attacker with access take their privileges to the next level! Think of it like a restaurant where a waiter can suddenly decide to serve themselves from the kitchen — they might start mixing up orders or even accessing the chef's secret recipes! In tech terms, this bug allows an authorized user to elevate their permissions unexpectedly. This could lead to a scenario where an attacker gains access to sensitive areas of the system, potentially allowing them to manipulate data, install malicious software, or even disrupt critical services. It's a serious risk that could lead to chaos in an otherwise secure environment!

Put simply

Think of it like a restaurant where a waiter can suddenly decide to serve themselves from the kitchen — they might start mixing up orders or even accessing the chef's secret recipes! In tech terms, this bug allows an authorized user to elevate their permissions unexpectedly. The vulnerability stems from improper handling of pointers in the Windows Remote Desktop service, which can allow an authenticated user to escalate their privileges and gain unauthorized access to system resources.

What to do

This could lead to a scenario where an attacker gains access to sensitive areas of the system, potentially allowing them to manipulate data, install malicious software, or even disrupt critical services. It's a serious risk that could lead to chaos in an otherwise secure environment! To protect your systems, ensure that you apply the latest security updates from Microsoft. Additionally, review user access permissions and enforce the principle of least privilege to minimize potential damage from any already authorized users. Regularly monitor and audit your remote access logs as well! You've got this! Stay vigilant and implement these fixes to keep your systems secure. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2025-11-11T17:59Z
EPSS history
Timeline
  • 11 NOV 17:59Z
    Windows Remote Desktop Services Elevation of Privilege Vulnerability
    cvelistv5