CVE-2025-49735 Overview
CVE-2025-49735 is a use-after-free vulnerability [CWE-416] in the Windows Key Distribution Center (KDC) Proxy Service (KPSSVC). An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on affected Windows Server systems over a network. The KDC Proxy Service relays Kerberos authentication traffic over HTTPS, making it commonly exposed for remote access scenarios such as Remote Desktop Gateway and DirectAccess.
Critical Impact
Successful exploitation allows unauthenticated remote code execution against the KDC Proxy Service, which often runs on Internet-facing infrastructure that brokers Kerberos authentication for the domain.
Affected Products
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2025-07-08 - CVE-2025-49735 published to NVD
- 2026-02-13 - Last updated in NVD database
Technical Details for CVE-2025-49735
Vulnerability Analysis
The vulnerability resides in KPSSVC, the Windows service that implements the KDC Proxy Protocol (KKDCP). KKDCP encapsulates Kerberos AS-REQ and TGS-REQ messages inside HTTPS requests, allowing remote clients to authenticate to a domain without direct Kerberos port exposure. A use-after-free condition occurs when the service references a memory object that has already been freed during message processing. An attacker who controls the contents and timing of the freed allocation can redirect execution flow to attacker-controlled data.
Because KPSSVC runs in a privileged context and accepts unauthenticated requests by design, exploitation yields code execution without valid credentials. The CWE-416 classification confirms the memory-management nature of the defect. Attack complexity is rated High, indicating the attacker must win a race condition or shape the heap to reliably trigger the freed-object reuse.
Root Cause
The root cause is improper object lifetime management within the KDC Proxy request handler. A code path releases a memory object while another execution path still holds and dereferences a pointer to that object. Microsoft has not published source-level details, but CWE-416 patterns in network services typically involve asynchronous request handling, error paths that free state prematurely, or reference-count mismatches during connection teardown.
Attack Vector
The attack is conducted over the network against the KPSSVC listener, typically TCP/443 when the proxy is published through IIS or a Remote Desktop Gateway. The attacker sends crafted KKDCP-encapsulated Kerberos messages designed to trigger the freed-object reuse, then sprays the heap to control the contents of the reused allocation. No authentication or user interaction is required. See the Microsoft CVE-2025-49735 Advisory for vendor guidance.
No public proof-of-concept exploit code is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-49735
Indicators of Compromise
- Unexpected crashes, restarts, or Watson error reports for the kpssvc.exe process on domain controllers or KDC Proxy hosts.
- Anomalous outbound network connections or child process creation originating from kpssvc.exe or its hosting svchost.exe instance.
- Spikes in malformed KKDCP requests to TCP/443 on Remote Desktop Gateway or KDC Proxy endpoints.
Detection Strategies
- Monitor the Windows Application and System event logs for service crash events (Event IDs 1000, 7031, 7034) referencing KPSSVC or kpssvc.dll.
- Inspect IIS and HTTP.sys logs on KDC Proxy hosts for unusual POST requests to the /KdcProxy endpoint, including oversized bodies or malformed Kerberos ASN.1 structures.
- Hunt for post-exploitation behavior such as LSASS access, new local accounts, or lateral movement originating from the KDC Proxy host.
Monitoring Recommendations
- Enable command-line and process-creation auditing on all servers running the KDC Proxy role.
- Forward KPSSVC and IIS telemetry to a centralized SIEM or data lake for correlation with authentication anomalies in Active Directory.
- Alert on any new outbound network sessions or scripting-engine executions launched as children of svchost.exe -k KdcProxy.
How to Mitigate CVE-2025-49735
Immediate Actions Required
- Apply the July 2025 Microsoft security updates to all affected Windows Server versions running the KDC Proxy role.
- Inventory every host with KPSSVC enabled, including Remote Desktop Gateway servers and DirectAccess infrastructure, and prioritize patching of Internet-facing systems.
- Restrict network exposure of the KDC Proxy endpoint to known client networks where feasible until patches are deployed.
Patch Information
Microsoft has released security updates addressing CVE-2025-49735 across Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Refer to the Microsoft CVE-2025-49735 Advisory for the specific KB articles and update packages corresponding to each supported Windows Server release.
Workarounds
- Disable the KPSSVC service on hosts that do not require KDC Proxy functionality until the patch can be applied.
- Place the KDC Proxy endpoint behind a TLS-terminating reverse proxy that performs strict KKDCP message validation and rate limiting.
- Apply network segmentation rules so that only authorized RDP Gateway or DirectAccess clients can reach TCP/443 on KDC Proxy servers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
