CVE-2025-54114 Overview
CVE-2025-54114 is a race condition vulnerability in the Windows Connected Devices Platform Service (CDPSvc). The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. An authorized local attacker can exploit the race window to elevate privileges on affected Windows systems. Microsoft assigned the vulnerability a CVSS 3.1 base score of 7.0 and rated it HIGH severity. The vulnerability affects a broad range of client and server Windows versions, including Windows 10, Windows 11, and Windows Server 2016 through 2025.
Critical Impact
A local, authenticated attacker who wins the race condition can gain elevated privileges, achieving full confidentiality, integrity, and availability compromise of the host.
Affected Products
- Microsoft Windows 10 (1607, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-54114 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54114
Vulnerability Analysis
The Connected Devices Platform Service (CDPSvc) coordinates cross-device experiences on Windows, including Nearby Sharing and roaming settings. The service runs with elevated privileges and exposes interfaces reachable from lower-privileged contexts. CVE-2025-54114 arises when CDPSvc accesses a shared resource without proper synchronization between concurrent threads. An attacker who triggers operations at precisely the right moment can manipulate state that the service assumes is stable.
Exploitation requires local access and valid authentication on the target host. The attack complexity is rated High, reflecting the timing precision needed to win the race window. When successful, the attacker inherits privileges of the service context, enabling arbitrary code execution outside the caller's original privilege boundary.
Root Cause
The root cause is a classic Time-of-Check to Time-of-Use (TOCTOU) class defect within CDPSvc. Two or more threads read or modify the same shared object without adequate locking, allowing a well-timed operation from another thread to alter state between validation and use. This synchronization gap is tracked as CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization.
Attack Vector
The attack vector is local. An attacker must already possess low-privilege code execution on the target, typically as a standard user. The attacker interacts with CDPSvc through its exposed interfaces while concurrently triggering the race condition. Because the CVSS vector indicates unchanged scope with high impact across confidentiality, integrity, and availability, a successful exploit yields SYSTEM-level control suitable for persistence, credential theft, or lateral movement staging.
No public proof-of-concept exploit code has been published for CVE-2025-54114 at the time of writing. Refer to the Microsoft Security Update Guide for CVE-2025-54114 for authoritative technical details.
Detection Methods for CVE-2025-54114
Indicators of Compromise
- Unexpected crashes, restarts, or hangs of the CDPSvc service recorded in the System event log
- Child processes spawned by svchost.exe hosting CDPSvc that do not match normal baselines
- New services, scheduled tasks, or privileged accounts created shortly after CDPSvc anomalies
- Anomalous access to Connected Devices Platform user data directories under %LOCALAPPDATA%\ConnectedDevicesPlatform
Detection Strategies
- Hunt for standard user processes that repeatedly invoke Connected Devices Platform APIs in rapid succession, which is characteristic of race-window brute forcing
- Monitor for process token elevation events where the parent process is not typically privileged
- Correlate Sysmon Event ID 1 (process creation) with unexpected integrity level transitions originating from svchost.exe -k LocalService
Monitoring Recommendations
- Enable Windows Security Auditing for privilege use and process creation with command-line logging
- Baseline CDPSvc behavior across the fleet and alert on statistical outliers such as thread count spikes or handle exhaustion
- Forward endpoint telemetry to a centralized analytics platform for cross-host correlation of exploitation attempts
How to Mitigate CVE-2025-54114
Immediate Actions Required
- Apply the Microsoft security update for CVE-2025-54114 to all affected Windows client and server systems
- Prioritize patching on multi-user hosts, jump servers, and any endpoint where untrusted users hold interactive logon rights
- Audit local group memberships and remove unnecessary interactive logon privileges to limit exposure
Patch Information
Microsoft released a security update addressing CVE-2025-54114. Consult the Microsoft Security Update Guide for CVE-2025-54114 for the specific KB article, build numbers, and download links applicable to each affected Windows version. Deploy through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or your standard patch management tooling.
Workarounds
- If patching cannot be performed immediately, restrict interactive and remote logon rights to trusted administrators only
- Consider disabling the Connected Devices Platform Service (CDPSvc) on servers and workstations that do not require cross-device experiences, after validating impact on Nearby Sharing and related features
- Apply application control policies such as Windows Defender Application Control (WDAC) to block unauthorized binaries that could stage the exploit
# Query CDPSvc status and disable it on hosts that do not require the service
sc.exe query CDPSvc
sc.exe config CDPSvc start= disabled
sc.exe stop CDPSvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
