CVE-2025-55230: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-55230 Overview

CVE-2025-55230 is a local privilege escalation vulnerability in the Windows MBT (NetBIOS over TCP) Transport driver. The flaw stems from an untrusted pointer dereference [CWE-822] within the kernel-mode driver. An authorized local attacker who can execute code on an affected system can leverage the flaw to elevate privileges to SYSTEM. Microsoft published the advisory on August 21, 2025, covering all supported Windows client and server releases. The vulnerability affects confidentiality, integrity, and availability at the operating system level.

Critical Impact
A local, authenticated attacker can dereference an untrusted pointer in the MBT Transport driver to execute arbitrary code in kernel context, resulting in full SYSTEM privilege escalation.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-08-21 - CVE-2025-55230 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55230

Vulnerability Analysis

The vulnerability resides in the Windows MBT Transport driver (mbt.sys), which implements NetBIOS over TCP/IP session services in the Windows kernel. The driver processes input from user-mode callers and dereferences a pointer without verifying that the pointer references a valid, trusted kernel object. An attacker with local, low-privileged access can craft input that steers the driver toward attacker-controlled memory. When the driver dereferences that pointer, it operates on attacker-controlled data at kernel privilege. This condition enables arbitrary read, write, or code execution primitives inside the kernel, and results in a full local privilege escalation from a standard user to SYSTEM.

Root Cause

The root cause is classified as CWE-822: Untrusted Pointer Dereference. The MBT Transport driver accepts pointer values or structures derived from an untrusted source and uses them in a dereference operation without adequate validation. Missing checks on origin, alignment, or object type allow the kernel to follow the attacker-supplied address.

Attack Vector

Exploitation requires local access and a low-privileged user account. No user interaction is needed. The attacker interacts with the MBT Transport driver, typically through a device I/O control (IOCTL) interface or an equivalent kernel object handle, and supplies input that triggers the flawed pointer dereference. Successful exploitation grants kernel-level code execution and complete control of the host.

No verified public proof-of-concept code is available for CVE-2025-55230 at this time. See the Microsoft CVE-2025-55230 Advisory for authoritative technical guidance.

Detection Methods for CVE-2025-55230

Indicators of Compromise

Unexpected mbt.sys driver crashes, bug checks, or kernel exceptions logged in System event logs and Windows Error Reporting.
Non-service processes (for example, user shells or scripting interpreters) opening handles to NetBIOS or MBT transport device objects.
Sudden token elevation events where a standard user process transitions to NT AUTHORITY\SYSTEM without a legitimate parent service.
New services, scheduled tasks, or persistence artifacts created by a process that recently escalated from a low-integrity context.

Detection Strategies

Monitor kernel bug check codes and unexpected reboots that reference the MBT transport driver as the faulting module.
Baseline which processes legitimately open handles to NetBIOS/MBT device objects and alert on deviations.
Correlate local logon events with subsequent token elevation to SYSTEM originating from non-service parent processes.
Enable Microsoft Defender Attack Surface Reduction and kernel-mode driver telemetry to surface anomalous IOCTL patterns.

Monitoring Recommendations

Ingest Windows Security, System, and Sysmon logs into a centralized SIEM for correlation across endpoints.
Track patch state for the August 2025 Windows security update across all client and server SKUs listed in the advisory.
Alert on privilege escalation patterns: standard user process spawning SYSTEM-level children within a short time window.

How to Mitigate CVE-2025-55230

Immediate Actions Required

Apply the August 2025 Microsoft security update that addresses CVE-2025-55230 to all affected Windows and Windows Server systems.
Prioritize patching multi-user hosts, terminal servers, and jump boxes where local, low-privileged access is common.
Restrict local logon rights and interactive access on servers to reduce the pool of accounts that can trigger the flaw.
Audit local accounts and remove unused low-privileged accounts that could be used to stage a local exploit.

Patch Information

Microsoft has released updates through the Microsoft Update Catalog and Windows Update. Refer to the Microsoft CVE-2025-55230 Advisory for the specific KB article and package for each Windows version. Install the update on every affected SKU, including legacy Windows Server 2008 and 2012 systems covered by Extended Security Updates.

Workarounds

Disable NetBIOS over TCP/IP on network adapters where the protocol is not required, reducing exposure of the MBT transport surface.
Enforce application allowlisting (Windows Defender Application Control or AppLocker) to block untrusted binaries from running as local users.
Apply the principle of least privilege and prevent standard users from executing unsigned or untrusted code on servers.
Segment and isolate hosts that cannot be patched immediately, and monitor them with elevated logging until updates are applied.

bash

# Disable NetBIOS over TCP/IP on all adapters via PowerShell
$adapters = Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter "IPEnabled=TRUE"
foreach ($adapter in $adapters) {
    # 2 = Disable NetBIOS over TCP/IP
    $adapter.SetTcpipNetbios(2)
}

# Verify installation of the August 2025 cumulative update
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10