CVE-2025-54895 Overview
CVE-2025-54895 is an integer overflow vulnerability [CWE-190] in the Windows Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) Extended Negotiation component. The flaw allows an authorized local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on September 9, 2025, covering client and server editions from Windows 10 1507 through Windows 11 24H2, and from Windows Server 2008 R2 through Windows Server 2025.
The vulnerability requires local access and low privileges, but successful exploitation results in high impact to confidentiality, integrity, and availability across a security scope change.
Critical Impact
A local authenticated attacker can trigger an integer overflow in SPNEGO Extended Negotiation to gain elevated privileges, potentially reaching SYSTEM-level execution on affected Windows hosts.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
- Microsoft Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-54895 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54895
Vulnerability Analysis
SPNEGO Extended Negotiation (NEGOEX) is the Windows authentication mechanism that negotiates security packages such as Kerberos and NTLM during Security Support Provider Interface (SSPI) exchanges. The vulnerability stems from an integer overflow or wraparound condition [CWE-190] when the component processes length or size fields during token parsing.
When an attacker crafts a malformed NEGOEX token, arithmetic on untrusted size values wraps past the maximum integer boundary. Subsequent memory operations allocate or copy based on the wrapped value, leading to memory corruption within a privileged authentication context. The scope change indicator (S:C) in the CVSS vector confirms the impact crosses the original security boundary.
Exploitation is complex, requiring the attacker to control timing or state to reliably trigger the overflow. However, successful exploitation yields full compromise of confidentiality, integrity, and availability on the host.
Root Cause
The root cause is an unchecked arithmetic operation on length or offset values inside the Windows SPNEGO Extended Negotiation code path. Because SPNEGO runs inside authentication components loaded by lsass.exe and related security packages, corrupted state can be leveraged to elevate the caller's privilege level.
Attack Vector
The attack vector is local (AV:L) and requires an authorized user context (PR:L). No user interaction is needed. An attacker with a low-privileged account submits crafted SPNEGO/NEGOEX tokens to a local authentication endpoint, triggering the overflow during token processing. The vulnerability manifests during the negotiation exchange, meaning any local interface that funnels tokens into NegoEx handlers is a potential entry point. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-54895
Indicators of Compromise
- Unexpected crashes or restarts of lsass.exe or authentication-related services on Windows hosts
- Anomalous SPNEGO or NEGOEX token traffic originating from local processes owned by low-privileged users
- Newly spawned SYSTEM-level processes with a parent lineage tracing back to a standard user session
- Windows Error Reporting entries referencing NegoExtender.dll or SSPI-related modules
Detection Strategies
- Monitor process creation events (Windows Event ID 4688 and Sysmon Event ID 1) where a standard user context transitions to SYSTEM without a corresponding legitimate elevation path
- Alert on abnormal termination or module load anomalies in lsass.exe, treating any crash as a high-severity signal
- Correlate authentication package load events with process integrity level changes in the same session
Monitoring Recommendations
- Ingest Windows Security, System, and Sysmon logs into a centralized analytics platform for cross-host correlation
- Track privilege escalation patterns using MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation)
- Baseline authentication traffic volumes and flag statistical deviations at endpoints running unpatched Windows builds
How to Mitigate CVE-2025-54895
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft CVE-2025-54895 Advisory to all affected Windows client and server builds
- Prioritize domain controllers, jump hosts, and multi-user servers where local privilege escalation carries the highest downstream impact
- Audit local account inventory and remove or disable unused low-privileged accounts that could serve as an exploitation foothold
Patch Information
Microsoft released updates addressing CVE-2025-54895 through the September 2025 Patch Tuesday cycle. Refer to the Microsoft CVE-2025-54895 Advisory for the specific Knowledge Base (KB) article and build numbers that apply to each Windows version listed in the affected products.
Workarounds
- No official workaround is documented by Microsoft; patching is the required remediation path
- Restrict interactive and remote local logon rights to trusted administrative users until updates are deployed
- Enforce application allowlisting to prevent unauthorized binaries from initiating SPNEGO negotiation flows
- Enable Credential Guard and Protected Process Light (PPL) for LSA where supported to raise the exploitation cost
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
