CVE-2025-40979: Windows 11 wave.exe RCE Vulnerability

CVE-2025-40979 Overview

CVE-2025-40979 is a DLL search order hijacking vulnerability in the wave.exe executable of Grandstream Wave version 1.27.8 for Windows 11. An attacker with local access can place a malicious file in the C:\Users\<user>\AppData\Local\Temp directory to achieve arbitrary code execution. The flaw is limited to Windows 11 and does not affect earlier Windows versions. The weakness maps to CWE-427: Uncontrolled Search Path Element.

Critical Impact
Local attackers can execute arbitrary code in the context of the Wave application and establish persistence by dropping a crafted DLL in the user's writable Temp directory.

Affected Products

Grandstream Wave wave.exe version 1.27.8
Windows 11 host operating system
Earlier Windows versions are not affected

Discovery Timeline

2025-09-10 - CVE-2025-40979 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40979

Vulnerability Analysis

The Grandstream Wave client for Windows loads one or more dependent DLLs without specifying a fully qualified path. When wave.exe starts, the Windows loader walks the default DLL search order and evaluates writable, user-controlled directories before secure system locations. On Windows 11 the search path resolves through C:\Users\<user>\AppData\Local\Temp, giving any standard user a location to plant a malicious library.

Exploitation requires the attacker to already have local, low-privilege access and the ability to induce or wait for the user to launch Wave. When the application starts, the planted DLL is mapped into the trusted process and its DllMain executes with the privileges of the invoking user. Because the Temp folder persists, the attacker can also use this as a persistence mechanism tied to normal application launches.

Root Cause

The root cause is insecure DLL resolution [CWE-427]. wave.exe calls LoadLibrary-style APIs on a bare module name rather than an absolute path, and it does not call SetDefaultDllDirectories or use LOAD_LIBRARY_SEARCH_SYSTEM32 to constrain the search order. Windows 11 changes to loader search behavior expose the executable path where earlier Windows releases did not.

Attack Vector

The attack vector is local and requires user interaction. An attacker with an interactive session drops a crafted DLL matching a name that Wave attempts to resolve into C:\Users\<user>\AppData\Local\Temp. When the victim next launches wave.exe, the loader binds to the attacker-controlled DLL and executes its entry point in the Wave process. See the INCIBE Security Notice for the vendor coordination details. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2025-40979

Indicators of Compromise

Unexpected DLL files written to C:\Users\<user>\AppData\Local\Temp shortly before or during wave.exe startup
wave.exe loading modules from a user-writable path instead of its install directory or System32
Child processes or outbound network activity spawned by wave.exe that do not match its normal telephony behavior

Detection Strategies

Baseline the legitimate modules loaded by wave.exe and alert when new or unsigned DLLs appear in its module list
Monitor image-load telemetry (Sysmon Event ID 7 or equivalent EDR data) for DLL loads originating from AppData\Local\Temp
Correlate file-create events in Temp with a subsequent process start of wave.exe by the same user

Monitoring Recommendations

Enable and forward Sysmon events 1, 7, and 11 to a central analytics platform for image-load and file-create visibility
Track code-signing status of every DLL loaded by wave.exe and flag unsigned or non-Grandstream signers
Review scheduled tasks and shortcuts that auto-launch Wave, since they magnify persistence opportunities via planted DLLs

How to Mitigate CVE-2025-40979

Immediate Actions Required

Inventory all Windows 11 hosts running Grandstream Wave 1.27.8 and prioritize them for remediation
Restrict write permissions or apply AppLocker/WDAC rules to block DLL execution from %LOCALAPPDATA%\Temp
Remove any unauthorized DLLs currently residing in user Temp directories on Wave-enabled endpoints

Patch Information

At the time of publication, no fixed version is enumerated in the NVD entry. Consult the INCIBE Security Notice and Grandstream vendor channels for updated releases addressing the insecure DLL search behavior in wave.exe.

Workarounds

Enforce application control policies that only permit DLL loads from the Wave installation directory and System32
Deploy a Software Restriction Policy or WDAC rule that denies execution of unsigned DLLs under user profile paths
Limit interactive logon on hosts running Wave to reduce the population of local users who can drop files into Temp

bash

# Example AppLocker DLL rule to block DLL execution from user Temp
# Deploy via Group Policy: Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker > DLL Rules
# Rule type: Deny
# User or group: Everyone
# Path: %OSDRIVE%\Users\*\AppData\Local\Temp\*
# File type: DLL (*.dll, *.ocx)