CVE-2025-21183 Overview
CVE-2025-21183 is an elevation of privilege vulnerability in the Windows Resilient File System (ReFS) Deduplication Service. The flaw is tracked as a double free condition [CWE-415] affecting Windows 11 24H2 and Windows Server 2025. A local attacker who successfully exploits this vulnerability can elevate privileges to SYSTEM, gaining full control over the affected host. Microsoft published the advisory on February 11, 2025 as part of its monthly security update cycle.
Critical Impact
Local attackers can corrupt memory in the ReFS Deduplication Service to achieve SYSTEM-level code execution, fully compromising confidentiality, integrity, and availability on Windows 11 24H2 and Windows Server 2025 hosts.
Affected Products
- Microsoft Windows 11 version 24H2
- Microsoft Windows Server 2025 (x64)
- Systems with the ReFS Deduplication Service enabled
Discovery Timeline
- 2025-02-11 - CVE-2025-21183 assigned and Microsoft releases security patch
- 2025-02-11 - CVE-2025-21183 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21183
Vulnerability Analysis
The vulnerability resides in the Windows ReFS Deduplication Service, a component that scans volumes for redundant data blocks and replaces duplicates with references to a single stored copy. Microsoft classifies this issue under [CWE-415] Double Free, meaning the service releases the same memory region more than once during processing.
Exploitation requires local access and no user interaction, but Microsoft notes elevated attack complexity. The attacker must win a race or shape allocator state to achieve reliable memory corruption. Successful exploitation grants the attacker code execution in the security context of the service, which runs with SYSTEM privileges.
The scope remains unchanged, but full impact across confidentiality, integrity, and availability is realized once privilege elevation completes. Attackers commonly chain such local privilege escalation flaws with initial-access vulnerabilities or phishing-delivered loaders to move from a low-privileged foothold to full host compromise.
Root Cause
The root cause is a double free condition in the ReFS Deduplication Service code path. Memory that has already been released is freed a second time, corrupting the heap allocator's internal bookkeeping. An attacker who controls allocation patterns around the freed object can reclaim the memory and pivot the double free into arbitrary write primitives.
Attack Vector
The attack vector is local. An attacker must be able to execute code on the target system as an unprivileged user. The actor then interacts with the ReFS Deduplication Service, likely by triggering specific file system operations on an ReFS volume that exercise the vulnerable code path. Microsoft has not published proof-of-concept code, and no public exploit is currently available. No code example is included because no verified exploit code has been released by Microsoft or independent researchers.
Detection Methods for CVE-2025-21183
Indicators of Compromise
- Unexpected crashes or restarts of the ReFS Deduplication Service (fsdmhost.exe) in the System event log
- Creation of new SYSTEM-level processes spawned by or shortly after deduplication activity on ReFS volumes
- New service installations, scheduled tasks, or local accounts following anomalous ReFS service behavior
- Unsigned or unusual binaries executed from user-writable paths immediately before service crashes
Detection Strategies
- Monitor Windows Error Reporting and crash dumps for faults originating in ReFS deduplication modules
- Alert on process lineage where a low-privileged user session is followed by SYSTEM-context child processes without a corresponding legitimate elevation event
- Hunt for unauthorized invocation of deduplication PowerShell cmdlets such as Enable-DedupVolume or Start-DedupJob from non-administrative contexts
Monitoring Recommendations
- Enable Windows audit policies for process creation (Event ID 4688) with command-line logging on all ReFS-enabled servers
- Forward Security, System, and Application event logs to a centralized SIEM for correlation across hosts
- Baseline normal ReFS Deduplication Service behavior and alert on deviations in CPU, memory, and child process patterns
How to Mitigate CVE-2025-21183
Immediate Actions Required
- Apply the February 2025 Microsoft security update for Windows 11 24H2 and Windows Server 2025 without delay
- Inventory all systems using ReFS volumes with deduplication enabled and prioritize them for patching
- Restrict interactive and remote logon rights on affected hosts to reduce the pool of users who can stage local exploitation
- Review privileged access management policies to limit lateral movement opportunities once a host is compromised
Patch Information
Microsoft has released a security update addressing CVE-2025-21183. Refer to the Microsoft Security Update Guide for CVE-2025-21183 for the specific KB articles and cumulative update packages applicable to Windows 11 24H2 and Windows Server 2025. Apply the update through Windows Update, WSUS, or your enterprise patch management tooling.
Workarounds
- No official workaround has been published by Microsoft; patching is the recommended remediation path
- Where patching must be delayed, consider disabling the ReFS Deduplication Service on non-essential volumes using Disable-DedupVolume until the update is deployed
- Enforce application allowlisting to block execution of unauthorized binaries that could trigger the vulnerable code path
# Verify patch status and deduplication configuration on Windows Server 2025
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Get-DedupVolume | Format-Table Volume, Enabled, SavedSpace, UsageType
# Temporarily disable deduplication on a specific volume if patching is delayed
Disable-DedupVolume -Volume "D:"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
