CVE-2025-47976: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-47976 Overview

CVE-2025-47976 is a use-after-free vulnerability [CWE-416] in the Windows Simple Service Discovery Protocol (SSDP) Service. An authorized local attacker can exploit the flaw to elevate privileges on the affected host. Microsoft published the advisory on July 8, 2025, and the issue affects a broad range of Windows client and server releases, from Windows 10 1507 through Windows 11 24H2, and from Windows Server 2008 through Windows Server 2025.

Successful exploitation allows an attacker with low-privilege local access to gain higher privileges, with high impact to confidentiality, integrity, and availability.

Critical Impact
Local privilege escalation to SYSTEM-level code execution on unpatched Windows hosts through memory reuse in the SSDP Service.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019 (including R2 and SP editions)
Microsoft Windows Server 2022, 2022 23H2, and Windows Server 2025

Discovery Timeline

2025-07-08 - CVE-2025-47976 published to NVD
2025-07-08 - Microsoft releases security update through MSRC
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47976

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Windows SSDP Service (ssdpsrv). SSDP is a network protocol used by Universal Plug and Play (UPnP) for advertising and discovering network services and presence information. The service runs under a privileged context on Windows hosts.

A use-after-free flaw occurs when a program continues to reference memory after it has been released back to the allocator. If an attacker can influence the allocation state between the free and the subsequent access, the reused memory can be replaced with attacker-controlled data. In this case, the corrupted object is dereferenced by the SSDP Service, giving the attacker control over execution flow within a privileged process.

The attack requires local access and low-level privileges, but no user interaction. Successful exploitation yields elevation of privileges with high impact on confidentiality, integrity, and availability.

Root Cause

The underlying defect is improper lifetime management of a heap object handled by the SSDP Service. Object references are retained after the backing memory has been freed, allowing subsequent operations to operate on a dangling pointer. Microsoft has not published detailed technical internals beyond the MSRC advisory.

Attack Vector

An authenticated local user triggers a specific sequence of SSDP Service operations to free a heap-allocated object and then coerce the service into using the stale pointer. Because SSDP runs with higher privileges than a standard user, control over the freed object translates into privileged code execution. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft Security Update CVE-2025-47976 advisory for vendor-supplied technical context.

Detection Methods for CVE-2025-47976

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting (WER) entries associated with the SSDPSRV service or the svchost.exe process hosting it.
New child processes spawned from svchost.exe instances that host SSDPSRV, particularly interactive shells or LOLBins.
Local user accounts suddenly performing actions requiring SYSTEM privileges without a corresponding legitimate escalation path.

Detection Strategies

Monitor process creation events (Sysmon Event ID 1 or Windows Event ID 4688) for anomalous descendants of svchost.exe -k LocalService groups that include SSDP.
Alert on service crash events (Event ID 7031, 7034) referencing the SSDP Discovery service, which can indicate failed exploitation attempts.
Correlate low-privileged user logons with subsequent SYSTEM-context activity on the same host within a short time window.

Monitoring Recommendations

Ensure endpoint telemetry captures process, module load, and privilege-change events for services hosted under svchost.exe.
Track patch-compliance state for the July 2025 Microsoft security updates across all Windows client and server assets.
Baseline SSDP traffic and service activity so deviations, including repeated restarts, surface quickly in monitoring dashboards.

How to Mitigate CVE-2025-47976

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-47976 to all affected Windows client and server systems.
Prioritize patching on multi-user hosts, jump servers, and any system where low-privileged users can log on locally.
Audit local account inventories and remove unnecessary interactive logon rights to reduce the pool of accounts able to reach the vulnerable code path.

Patch Information

Microsoft addressed CVE-2025-47976 in security updates issued through the MSRC update guide. Consult the Microsoft Security Update CVE-2025-47976 page for the specific KB articles and cumulative updates that apply to each Windows build listed under Affected Products.

Workarounds

Disable the SSDP Discovery service (SSDPSRV) on systems that do not require UPnP or media-sharing functionality.
Restrict local logon rights through Group Policy so that only trusted administrative accounts can interact with affected hosts.
Apply application control policies to limit which binaries low-privileged users can execute, reducing the ability to stage exploitation primitives.

bash

# Configuration example: disable SSDP Discovery where UPnP is not required
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV

# Verify service state
sc.exe query SSDPSRV