CVE-2025-53724 Overview
CVE-2025-53724 is a type confusion vulnerability [CWE-843] in the Windows Push Notifications component. An authorized local attacker can access a resource using an incompatible type and elevate privileges on the affected host. Microsoft assigned this issue a CVSS 3.1 score of 7.8 with a local attack vector and low privileges required.
The flaw affects a broad range of Windows client and server releases, from Windows 10 1507 through Windows 11 24H2, and Windows Server 2012 through Windows Server 2025. Successful exploitation yields high impact to confidentiality, integrity, and availability, typically resulting in SYSTEM-level code execution.
Critical Impact
A local, authenticated user can abuse a type confusion condition in Windows Push Notifications to escalate to SYSTEM, giving full control of the endpoint.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-08-12 - CVE-2025-53724 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53724
Vulnerability Analysis
The vulnerability resides in the Windows Push Notifications service, which handles toast notifications, background tasks, and inter-process messaging for UWP and system components. The service runs with elevated privileges and processes structured data received from lower-privileged callers. When it interprets a resource using an incompatible type, memory that represents one object layout is treated as another.
Type confusion [CWE-843] typically arises when code casts a pointer or handle without verifying the underlying object type. The mismatched interpretation lets an attacker corrupt adjacent fields, redirect function pointers, or read privileged memory.
Because Push Notifications interacts with per-user callers through RPC and COM interfaces, a standard user process can supply crafted input that the privileged service consumes. The resulting confusion is leveraged to achieve arbitrary code execution in the security context of the service.
Root Cause
The root cause is missing or insufficient runtime type verification before a cast or dispatch inside the Push Notifications code path. A field intended to identify object type can be forged or mismatched, and downstream logic dereferences the object as if it were a different type. This creates an exploitable primitive when attacker-controlled data reaches virtual method tables, callbacks, or size fields.
Attack Vector
Exploitation requires local access and a valid user session on the target. The attacker sends crafted notification or subscription requests over the Push Notifications RPC/COM surface. The service consumes the malformed object, mishandles the type, and control flow is diverted into attacker-controlled data. The end result is code execution as the notification service account, followed by escalation to SYSTEM.
No verified public proof-of-concept code is available at this time. See the Microsoft CVE-2025-53724 Advisory for vendor technical details.
Detection Methods for CVE-2025-53724
Indicators of Compromise
- Unexpected child processes spawned by WpnUserService.exe or WpnService.dll-hosted svchost.exe instances running as SYSTEM.
- Crashes or access violations logged in the Application event log referencing the Windows Push Notifications User Service or WpnService.
- New or modified scheduled tasks, services, or LSA secrets created immediately after Push Notifications service activity by non-administrative users.
Detection Strategies
- Hunt for token elevation events (Event ID 4672) tied to processes whose parent is a Push Notifications service host.
- Alert on non-standard modules loaded into svchost.exe hosting WpnUserService or WpnService, particularly unsigned DLLs from user-writable paths.
- Correlate local logons (Event ID 4624 type 2/10) with subsequent SYSTEM process creation and RPC activity to \pipe\ endpoints exposed by the notification stack.
Monitoring Recommendations
- Enable command-line and module-load auditing across all Windows endpoints and forward Sysmon events to a centralized SIEM.
- Monitor Windows Error Reporting for repeated faults in the Push Notifications service, which can indicate exploitation attempts.
- Baseline normal Push Notifications behavior per host so anomalous IPC volume or unexpected callers stand out.
How to Mitigate CVE-2025-53724
Immediate Actions Required
- Apply the Microsoft August 2025 security update that addresses CVE-2025-53724 on all affected Windows 10, Windows 11, and Windows Server versions.
- Prioritize patching multi-user systems, jump hosts, and workstations belonging to privileged users, where local EoP has the highest blast radius.
- Enforce least privilege so standard users cannot install tooling or run untrusted binaries that stage local exploitation.
Patch Information
Microsoft has released fixes through the Windows Update channel. Refer to the Microsoft CVE-2025-53724 Advisory for the specific KB article and build numbers that correspond to each supported Windows release. Install the update, reboot, and confirm the OS build matches the fixed version listed in the advisory.
Workarounds
- No official workaround is documented by Microsoft; applying the security update is the only supported remediation.
- On systems where patching must be delayed, restrict interactive and remote logon rights so untrusted users cannot obtain the local access required to exploit the flaw.
- Use application control (WDAC or AppLocker) to block execution of unknown binaries from user-writable directories, reducing the ability to run local EoP tooling.
# Verify the installed Windows build against the patched version listed in the MSRC advisory
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe list brief /format:table
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
