CVE-2025-49735: Windows KDC Proxy Use After Free RCE

CVE-2025-49735 Overview

CVE-2025-49735 is a critical Use After Free (UAF) vulnerability in the Windows KDC Proxy Service (KPSSVC) that enables unauthorized attackers to execute arbitrary code over a network. This vulnerability affects the Kerberos Key Distribution Center proxy service, a crucial component used in enterprise environments for Kerberos authentication when clients cannot directly access a domain controller.

The KDC Proxy Service acts as an HTTPS-based gateway for Kerberos traffic, commonly deployed in remote access scenarios and DirectAccess implementations. Successful exploitation of this memory corruption vulnerability could allow attackers to gain complete control over affected systems without requiring prior authentication.

Critical Impact

Unauthorized remote code execution via network attack on Windows KDC Proxy Service with no authentication required, potentially compromising domain authentication infrastructure.

Affected Products

• Windows Server systems running KDC Proxy Service (KPSSVC)
• Windows environments utilizing Kerberos over HTTPS for remote authentication
• DirectAccess and remote access deployments using KDC Proxy

Discovery Timeline

• July 8, 2025 - CVE-2025-49735 published to NVD
• July 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-49735

Vulnerability Analysis

This Use After Free vulnerability (CWE-416) exists within the Windows KDC Proxy Service, specifically affecting how the service manages memory during the processing of Kerberos authentication requests. Use After Free vulnerabilities occur when a program continues to reference memory after it has been freed, potentially allowing an attacker to manipulate the freed memory and achieve code execution.

The KDC Proxy Service handles network-facing Kerberos ticket requests over HTTPS, making it an attractive target for remote attackers. The vulnerability can be exploited without user interaction, though successful exploitation requires overcoming memory layout challenges, resulting in a higher attack complexity classification.

The impact of successful exploitation is severe, potentially affecting confidentiality, integrity, and availability of the target system. An attacker who successfully exploits this vulnerability could execute arbitrary code in the context of the KPSSVC service, potentially gaining elevated privileges on the target system and compromising Kerberos authentication infrastructure.

Root Cause

The vulnerability stems from improper memory management within KPSSVC where the service fails to properly track and validate memory object lifecycles. When certain sequences of Kerberos proxy requests are processed, memory that has been freed may still be referenced by active code paths, creating a Use After Free condition.

This type of vulnerability typically occurs when:

• Memory is allocated for handling a request
• The memory is freed before all references to it are cleared
• Subsequent operations attempt to use the dangling pointer
• An attacker can influence the contents of the reallocated memory region

Attack Vector

The attack is network-based and can be initiated by an unauthorized attacker without requiring any user interaction. The attacker needs network access to the KDC Proxy Service endpoint (typically exposed on HTTPS port 443) to send specially crafted Kerberos proxy requests.

The exploitation process involves sending malicious requests that trigger the use-after-free condition, then carefully timing subsequent requests to control the freed memory contents. By placing attacker-controlled data in the freed memory region, code execution can be achieved when the stale pointer is dereferenced.

Due to the complexity of heap manipulation required and the need to bypass modern memory protections such as Address Space Layout Randomization (ASLR), exploitation complexity is considered high. However, no privileges or authentication are required to attempt exploitation.

For detailed technical information about this vulnerability, refer to the Microsoft Vulnerability Advisory CVE-2025-49735.

Detection Methods for CVE-2025-49735

Indicators of Compromise

• Abnormal crash events or service restarts associated with KPSSVC.dll or the KDC Proxy Service
• Unexpected memory access violations or heap corruption errors in Windows event logs
• Unusual network traffic patterns to the KDC Proxy Service endpoint with malformed Kerberos requests
• Process execution or child process spawning from the KPSSVC service context

Detection Strategies

• Monitor Windows event logs for KDC Proxy Service crashes or unexpected terminations
• Implement network intrusion detection rules to identify malformed Kerberos over HTTPS traffic
• Enable crash dump collection for KPSSVC to analyze potential exploitation attempts
• Deploy endpoint detection solutions to monitor for suspicious process behavior from Windows services

Monitoring Recommendations

• Enable verbose logging for the KDC Proxy Service and monitor for anomalous authentication patterns
• Implement network traffic analysis for KDC Proxy endpoints to detect exploitation attempts
• Configure security monitoring for unusual memory allocation patterns in critical Windows services
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities resulting from successful UAF attacks

How to Mitigate CVE-2025-49735

Immediate Actions Required

• Apply Microsoft security updates as soon as they are available from the Microsoft Security Update Guide
• Restrict network access to KDC Proxy Service endpoints to only trusted networks and clients
• Implement network segmentation to limit exposure of KDC Proxy services to the internet
• Monitor systems for signs of compromise while awaiting patch deployment

Patch Information

Microsoft has released security guidance for this vulnerability. Administrators should consult the Microsoft Vulnerability Advisory CVE-2025-49735 for specific patch information and affected Windows versions. Apply the appropriate security update for your Windows Server version immediately.

Ensure that all Windows Server systems running KDC Proxy Service are updated through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog.

Workarounds

• Disable the KDC Proxy Service if not required for business operations
• Implement strict firewall rules limiting access to the KDC Proxy endpoint to known, trusted IP addresses
• Use VPN solutions instead of KDC Proxy for remote Kerberos authentication where feasible
• Deploy Web Application Firewall (WAF) rules to filter potentially malicious Kerberos proxy requests

# Disable KDC Proxy Service if not required
Stop-Service -Name KPSSVC
Set-Service -Name KPSSVC -StartupType Disabled

# Verify service status
Get-Service -Name KPSSVC | Select-Object Name, Status, StartType