CVE-2025-26679 Overview
CVE-2025-26679 is a use-after-free vulnerability [CWE-416] in the Microsoft Windows Remote Procedure Call (RPC) Endpoint Mapper Service. An authenticated local attacker can trigger memory corruption to elevate privileges on the affected host. Microsoft published the advisory on April 8, 2025, and the flaw affects the full range of currently supported Windows client and server platforms.
Successful exploitation grants SYSTEM-level privileges, giving the attacker complete control over the compromised endpoint. The RPC Endpoint Mapper is a core Windows service, which broadens the exposure surface across enterprise fleets.
Critical Impact
Local attackers with standard user privileges can elevate to SYSTEM by exploiting a use-after-free condition in the RPC Endpoint Mapper Service, compromising confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-26679 published to the National Vulnerability Database
- 2025-04-08 - Microsoft releases security update through the April 2025 Patch Tuesday cycle
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-26679
Vulnerability Analysis
The vulnerability resides in the RPC Endpoint Mapper Service (RpcEptMapper), a component that maps RPC interface identifiers to dynamic endpoints. The service handles requests over the epmapper named pipe and TCP port 135. Improper object lifetime management inside the service causes memory to be freed while a pointer to that memory is still referenced.
An authorized attacker running code on the local machine can trigger the flawed code path through crafted RPC calls. Reusing the freed allocation lets the attacker control kernel or service memory, redirecting execution or corrupting security-critical data structures. Because the RPC Endpoint Mapper Service runs with SYSTEM privileges, successful exploitation results in local privilege escalation.
Root Cause
The root cause is a Use-After-Free (UAF) condition [CWE-416]. The service releases an object referenced by internal bookkeeping structures but continues to dereference the stale pointer. Attackers can groom the heap between the free and the reuse to place attacker-controlled data at the freed address.
Attack Vector
Exploitation requires local access and low-privileged authentication. No user interaction is needed. The attacker interacts with the RPC Endpoint Mapper through standard RPC client APIs and issues a specific sequence of calls that race or intentionally invoke the vulnerable free-then-reuse path. Technical exploitation details are described in the Microsoft Vulnerability Update CVE-2025-26679.
Detection Methods for CVE-2025-26679
Indicators of Compromise
- Unexpected crashes or restarts of the RpcEptMapper service in the System event log
- New SYSTEM-level processes spawned by low-privileged user sessions
- Anomalous local RPC traffic to the epmapper named pipe from non-administrative processes
Detection Strategies
- Monitor Windows Error Reporting and WER minidumps for faults in rpcss.dll or RpcEptMapper
- Correlate token elevation events (Event ID 4672) with parent processes running under standard user tokens
- Baseline expected callers of the RPC Endpoint Mapper interface and alert on unusual clients
Monitoring Recommendations
- Enable Microsoft-Windows-RPC and Microsoft-Windows-RPC-Events analytic channels for forensic visibility
- Track service crash frequency for RpcEptMapper across the fleet to identify exploitation attempts
- Alert on unsigned or unusual binaries invoking ncalrpc endpoints associated with the mapper service
How to Mitigate CVE-2025-26679
Immediate Actions Required
- Apply the April 2025 Microsoft security update for every affected Windows client and server SKU
- Prioritize domain controllers, jump servers, and multi-user hosts where local privilege escalation has the highest impact
- Restrict interactive and remote-interactive logon rights for untrusted users on sensitive systems
Patch Information
Microsoft issued fixes through the standard cumulative and monthly rollup updates referenced in the Microsoft Vulnerability Update CVE-2025-26679. Administrators should validate patch deployment through Windows Update for Business, WSUS, or configuration management tooling and confirm build numbers on affected endpoints.
Workarounds
- No official workaround exists; patching is the supported remediation
- Limit local logon and code execution rights to reduce the population able to reach the vulnerable service
- Apply application control policies to prevent unknown binaries from issuing local RPC calls
# Verify the RPC Endpoint Mapper service state and confirm patch level on Windows
Get-Service -Name RpcEptMapper | Format-List Name,Status,StartType
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
