CVE-2025-47975 Overview
CVE-2025-47975 is a double free vulnerability [CWE-415] in the Windows Simple Service Discovery Protocol (SSDP) Service. The flaw allows an authorized local attacker to elevate privileges on affected Windows systems. Microsoft disclosed the issue as part of its July 2025 security update cycle.
Successful exploitation results in high impact to confidentiality, integrity, and availability. The vulnerability affects nearly all supported Windows client and server editions, from Windows 10 1507 through Windows 11 24H2 and Windows Server 2008 through Windows Server 2025.
Critical Impact
A local attacker with low privileges can trigger a double free condition in the SSDP Service to escalate privileges and gain control over the affected host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-07-08 - CVE-2025-47975 published to NVD alongside Microsoft's security advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47975
Vulnerability Analysis
The Windows SSDP Service handles device discovery for Universal Plug and Play (UPnP). The service contains a double free condition classified under [CWE-415]. When triggered, the same memory region is released twice, corrupting the heap allocator's internal structures.
An authorized local attacker can leverage this corruption to manipulate heap metadata and redirect execution flow within the service process. Because the SSDP Service runs with elevated system privileges, successful exploitation yields privilege escalation on the affected host.
The CVSS vector indicates the attack requires local access, low privileges, and no user interaction. Attack complexity is rated high, reflecting the timing and heap-shaping conditions needed to exploit the flaw reliably.
Root Cause
The root cause is improper memory management within the SSDP Service. A code path frees a heap allocation and later frees the same pointer again without nullifying the reference or tracking ownership. This produces the double free condition tracked under [CWE-415].
Attack Vector
Exploitation requires local code execution as an authorized user. The attacker interacts with the SSDP Service through its exposed interfaces to trigger the vulnerable free path. After winning the required race or reaching the vulnerable state, the attacker leverages the corrupted heap to execute code in the context of the service. Refer to the Microsoft Security Update CVE-2025-47975 for vendor-specific technical guidance.
Detection Methods for CVE-2025-47975
Indicators of Compromise
- Unexpected crashes or restarts of the SSDP Discovery Service (SSDPSRV) recorded in the System event log
- Creation of new privileged accounts or scheduled tasks shortly after SSDP service anomalies
- Unusual child processes spawned by svchost.exe instances hosting the SSDP Service
Detection Strategies
- Monitor Windows Error Reporting and application crash telemetry for faults in modules loaded by the SSDP Service
- Correlate local privilege escalation behaviors with recent interactions targeting UPnP or SSDP endpoints
- Baseline process lineage for svchost.exe -k LocalService groups and alert on deviations
Monitoring Recommendations
- Enable process creation auditing (Event ID 4688) with command-line logging on Windows endpoints
- Ingest Sysmon events for image loads, process access, and handle activity against SSDP service processes
- Forward endpoint telemetry to a centralized SIEM for correlation across privilege escalation attempts
How to Mitigate CVE-2025-47975
Immediate Actions Required
- Apply the July 2025 Microsoft security update for CVE-2025-47975 to all affected Windows client and server systems
- Prioritize patching on multi-user hosts, jump servers, and terminal services where local low-privilege users have access
- Audit local account membership and remove unnecessary interactive logon rights
Patch Information
Microsoft has released security updates addressing CVE-2025-47975. Administrators should consult the Microsoft Security Update CVE-2025-47975 advisory for the specific update package that corresponds to each affected Windows build.
Workarounds
- Disable the SSDP Discovery Service (SSDPSRV) on systems that do not require UPnP functionality
- Restrict local interactive logon on servers and infrastructure hosts to reduce the attacker population
- Enforce application allowlisting to limit execution of untrusted binaries by standard users
# Disable the SSDP Discovery service where UPnP is not required
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
