CVE-2025-53721: Windows 10 1809 Privilege Escalation Flaw

CVE-2025-53721 Overview

CVE-2025-53721 is a use-after-free vulnerability in the Windows Connected Devices Platform Service (CDPSvc). An authorized local attacker can trigger the freed memory condition to elevate privileges on the affected host. The flaw is tracked under CWE-416 and impacts a broad range of Windows client and server releases. Microsoft addressed the issue in the August 2025 security update cycle. Successful exploitation grants confidentiality, integrity, and availability impact at the SYSTEM level.

Critical Impact
An authenticated local attacker who wins the required race condition can escalate to SYSTEM through memory reuse in the Connected Devices Platform Service.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-08-12 - CVE-2025-53721 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53721

Vulnerability Analysis

The Connected Devices Platform Service (CDPSvc.dll) manages cross-device experiences such as Nearby Sharing, Phone Link, and Continue on PC. The service runs under a shared svchost.exe host process with elevated privileges. A use-after-free condition in this component allows an authenticated local attacker to reference memory that has already been released back to the heap allocator. Winning the race condition requires precise timing, which is reflected in the high attack complexity. Once exploited, the attacker gains code execution in the security context of the service, enabling full local privilege escalation.

Root Cause

The flaw is a CWE-416 use-after-free. An object reference within CDPSvc remains reachable after the underlying allocation is released. Concurrent operations on the object result in dereferencing dangling memory. An attacker who controls the reallocation window can place attacker-influenced data at the freed address and hijack control flow when the stale pointer is used.

Attack Vector

Exploitation requires local access and low-privilege authentication on the target. The attacker interacts with the Connected Devices Platform Service through its exposed interprocess communication surface, then races the free and reuse operations. No user interaction is required. Microsoft has not reported public exploit code or in-the-wild abuse, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept is available. Refer to the Microsoft Security Update Guide for vendor-provided technical detail.

Detection Methods for CVE-2025-53721

Indicators of Compromise

Unexpected crashes, exceptions, or restarts of CDPSvc inside the shared svchost.exe -k LocalService process on affected Windows builds.
New or unusual child processes spawned by the svchost.exe instance hosting CDPSvc, particularly command shells or scripting engines.
Windows Error Reporting (WER) entries citing access violations in CDPSvc.dll or associated Connected Devices modules.

Detection Strategies

Monitor process integrity level transitions from Medium or Low IL processes to SYSTEM-owned children of svchost.exe.
Alert on abnormal handle counts, thread injection, or memory-write API usage targeting the CDPSvc-hosted svchost process from non-administrative callers.
Correlate service crash events (Event ID 7031, 7034) for the Connected Devices Platform Service with subsequent privilege escalation activity on the same host.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 8, 10, and 11 focused on the svchost group LocalService and CDPSvc-related image loads.
Baseline legitimate CDPSvc activity in enterprise environments where Nearby Sharing and Phone Link are disabled, and treat any activity as suspicious.
Track patch state across all Windows 10, Windows 11, and Windows Server variants listed in the Microsoft advisory to identify unpatched endpoints.

How to Mitigate CVE-2025-53721

Immediate Actions Required

Apply the August 2025 Microsoft security update that addresses CVE-2025-53721 to every affected Windows 10, Windows 11, and Windows Server build.
Prioritize multi-user systems, jump hosts, and terminal servers where local authenticated users are most likely to attempt privilege escalation.
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of accounts that satisfy the low-privilege precondition.

Patch Information

Microsoft released fixes for CVE-2025-53721 through the Microsoft Update channel. See the Microsoft Security Update Guide entry for CVE-2025-53721 for the specific KB articles that map to each Windows build.

Workarounds

Where cross-device features are not required, disable the Connected Devices Platform Service (CDPSvc) and the Connected Devices Platform User Service (CDPUserSvc) via Group Policy or sc.exe to remove the attack surface.
Restrict local logon and Remote Desktop access to trusted administrative accounts on shared hosts until patches are validated and deployed.
Enforce application control policies such as Windows Defender Application Control (WDAC) to block untrusted binaries that could stage the exploit primitive.

bash

# Disable Connected Devices Platform Service where cross-device features are not required
sc.exe config CDPSvc start= disabled
sc.exe stop CDPSvc

# Verify patch level after applying the August 2025 cumulative update
wmic qfe list brief /format:table