CVE-2025-24035: Windows 10 1507 RCE Vulnerability

CVE-2025-24035 Overview

CVE-2025-24035 is a remote code execution vulnerability in Windows Remote Desktop Services. The flaw stems from sensitive data being stored in improperly locked memory, classified as [CWE-591]. An unauthenticated attacker can exploit this condition over the network to execute arbitrary code on the target system. Microsoft published the advisory on March 11, 2025, and the issue affects a broad range of Windows client and server releases that expose Remote Desktop Services (RDS).

Critical Impact
Successful exploitation grants remote code execution on RDS hosts without authentication, enabling full compromise of confidentiality, integrity, and availability across Windows 10, Windows 11, and Windows Server platforms.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-03-11 - CVE-2025-24035 published to NVD and Microsoft releases security advisory
2025-07-03 - Last updated in NVD database

Technical Details for CVE-2025-24035

Vulnerability Analysis

The vulnerability resides in Windows Remote Desktop Services, the component that handles RDP session establishment and management. Sensitive data is placed into memory regions that are not locked appropriately, which means the data can be read or manipulated outside the intended security boundary. An attacker who interacts with the RDS endpoint over the network can leverage this exposure to influence program state and ultimately execute code on the host.

Because the flaw requires no authentication and no user interaction, exposed RDP services on the internet or in flat internal networks present a direct path to full system compromise. The high attack complexity reflects timing or race-related preconditions that an attacker must satisfy to reliably trigger code execution.

Root Cause

The root cause maps to [CWE-591]: Sensitive Data Storage in Improperly Locked Memory. Windows Remote Desktop Services holds security-relevant data in memory pages that are not pinned or otherwise protected from being paged out or accessed concurrently. This allows an attacker positioned over the network to influence the contents or reuse of that memory during RDP session processing, leading to remote code execution in the context of the RDS process.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker sends crafted RDP traffic to a vulnerable Remote Desktop Services endpoint, typically TCP port 3389. By triggering the unlocked-memory condition during session negotiation or data handling, the attacker corrupts process state and steers execution into attacker-controlled instructions. No verified public proof-of-concept code has been published. Refer to the Microsoft CVE-2025-24035 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-24035

Indicators of Compromise

Unexpected child processes spawned by svchost.exe hosting TermService or by rdpcorets.dll-loaded processes.
Anomalous outbound network connections originating from the Remote Desktop Services process shortly after inbound RDP traffic.
RDP session terminations followed by service crashes recorded in the System event log for TermService.

Detection Strategies

Monitor for inbound RDP connections from untrusted source IP addresses, especially from the internet to systems running unpatched Windows builds.
Alert on memory access violations or unexpected DLL loads inside the TermService process.
Correlate Windows Event IDs 1149, 4624 (Logon Type 10), and 4625 with abnormal session patterns to identify pre-authentication exploitation attempts.

Monitoring Recommendations

Centralize RDP authentication and service crash logs in a SIEM or data lake for correlation across hosts.
Track baseline RDS process behavior, including loaded modules, network endpoints, and child process creation, to surface deviations.
Continuously inventory systems exposing TCP 3389 internally and externally, prioritizing patch validation for those assets.

How to Mitigate CVE-2025-24035

Immediate Actions Required

Apply the Microsoft March 2025 security updates to all affected Windows 10, Windows 11, and Windows Server systems.
Restrict inbound TCP 3389 at the network perimeter and require VPN or zero-trust access for administrative RDP sessions.
Enable Network Level Authentication (NLA) on all hosts running Remote Desktop Services to reduce pre-authentication attack surface.
Audit exposure by enumerating systems with RDS enabled and confirming patch status before re-enabling external access.

Patch Information

Microsoft addressed CVE-2025-24035 in cumulative updates released on March 11, 2025. Consult the Microsoft CVE-2025-24035 Advisory for the specific KB articles and build numbers that correspond to each affected Windows version, including Windows Server 2008 SP2 and Server 2008 R2 SP1, which require Extended Security Updates.

Workarounds

Disable Remote Desktop Services on hosts that do not require it using the Services console or Set-Service -Name TermService -StartupType Disabled.
Place RDP hosts behind a Remote Desktop Gateway and enforce multi-factor authentication for all RDP access.
Apply host-based firewall rules to permit RDP only from designated administrative subnets.

bash

# Configuration example: restrict RDP access via Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Block-RDP-Public" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 3389 `
    -Action Block `
    -Profile Public,Domain

# Allow RDP only from a trusted admin subnet
New-NetFirewallRule -DisplayName "Allow-RDP-AdminSubnet" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 3389 `
    -RemoteAddress 10.20.30.0/24 `
    -Action Allow