CVE-2025-41686: NSSM Privilege Escalation Vulnerability

CVE-2025-41686 Overview

CVE-2025-41686 is a local privilege escalation vulnerability affecting the Non-Sucking Service Manager (nssm.exe). Improper file permissions on the nssm.exe binary allow a low-privileged local attacker to modify or replace the executable. When the associated service runs, the attacker's code executes with elevated privileges, granting administrative access to the host.

The issue is categorized under [CWE-306] (Missing Authentication for Critical Function) and carries a CVSS 3.1 base score of 7.8. CERT-VDE published advisory VDE-2025-063 documenting the flaw.

Critical Impact
A low-privileged local user can escalate to administrator by leveraging insecure permissions on nssm.exe, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows host.

Affected Products

Deployments using nssm.exe (Non-Sucking Service Manager) with insecure file or directory permissions
Windows systems where the vulnerable nssm.exe runs as a service under a privileged account
Refer to CERT-VDE Advisory VDE-2025-063 for the authoritative list of affected products

Discovery Timeline

2025-08-12 - CVE-2025-41686 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41686

Vulnerability Analysis

The vulnerability originates from insecure permissions applied to the nssm.exe binary or its containing directory. Non-privileged users possess write or modify rights on the executable file. This condition violates the principle that service binaries running as SYSTEM or another privileged account must be writable only by administrators.

An attacker with a standard local user account can replace nssm.exe with a malicious executable. When the Windows Service Control Manager next launches the service, the attacker-controlled binary executes in the security context of the configured service account. The result is arbitrary code execution with elevated privileges.

The flaw requires local access and low privileges. No user interaction is needed, and the attack complexity is low. Because nssm is commonly used to wrap arbitrary programs into Windows services, exploitation grants a reliable path from an unprivileged shell to full administrative control.

Root Cause

The root cause is improper access control on the nssm.exe file and, in some deployments, the directory containing it. When installation scripts or manual deployments leave default or overly permissive DACLs in place, members of groups such as Users or Authenticated Users inherit write access. [CWE-306] captures the underlying weakness: the service startup path lacks authentication or integrity validation for the binary it loads.

Attack Vector

The attack requires local, authenticated access. An attacker enumerates services managed by nssm.exe, checks the file's DACL using tools such as icacls or Get-Acl, and confirms write access. The attacker then overwrites nssm.exe with a malicious binary or a wrapper that spawns a privileged process. Execution occurs on the next service start, reboot, or explicit service restart. No exploit code is publicly available at the time of publication, and the flaw is not listed in the CISA KEV catalog.

See the CERT-VDE Advisory VDE-2025-063 for vendor-specific technical details.

Detection Methods for CVE-2025-41686

Indicators of Compromise

Unexpected modification timestamps on nssm.exe binaries deployed on production hosts
New or modified files in directories containing nssm.exe created by non-administrative accounts
Service processes spawned by nssm.exe launching unusual child processes such as cmd.exe, powershell.exe, or net.exe with SYSTEM privileges
Windows Event ID 7045 or 7040 entries showing service reconfiguration tied to nssm-managed services

Detection Strategies

Audit file permissions on all nssm.exe instances and flag any that grant write access to non-administrative principals
Monitor file integrity on service binaries using hash baselines and alert on unauthorized changes
Correlate service restart events with preceding file-write activity on the corresponding binary path

Monitoring Recommendations

Enable Windows Security Auditing for object access on directories containing nssm.exe
Ingest Sysmon Event ID 11 (FileCreate) and Event ID 1 (Process creation) into a centralized SIEM for service-binary paths
Track privilege escalation patterns where a low-integrity process precedes a SYSTEM-integrity child process rooted at nssm.exe

How to Mitigate CVE-2025-41686

Immediate Actions Required

Inventory every host running nssm.exe and review the DACL on the binary and its parent directory
Remove write, modify, and full-control permissions for Users, Authenticated Users, and other non-administrative groups
Restrict service binary directories to Administrators and SYSTEM with read and execute rights for standard users only
Review vendor guidance in CERT-VDE Advisory VDE-2025-063 and apply fixed versions when available

Patch Information

CERT-VDE published advisory VDE-2025-063 addressing this vulnerability. Consult the advisory for updated packages and fixed component versions. Apply vendor-provided patches to any product that bundles a vulnerable nssm.exe. No fixed version identifier is included in the NVD record at the time of writing.

Workarounds

Reset ACLs on nssm.exe using icacls "C:\Path\To\nssm.exe" /reset followed by explicit grants limited to Administrators and SYSTEM
Relocate nssm.exe to a directory such as %ProgramFiles% where default ACLs restrict non-administrative write access
Enable file integrity monitoring on service binaries to detect tampering before the next service start
Restrict interactive logon on hosts running nssm-managed services to reduce local attacker exposure

bash

# Configuration example: harden nssm.exe permissions
icacls "C:\Program Files\nssm\nssm.exe" /reset
icacls "C:\Program Files\nssm\nssm.exe" /inheritance:r
icacls "C:\Program Files\nssm\nssm.exe" /grant:r "Administrators:(F)" "SYSTEM:(F)" "Users:(RX)"