CVE-2025-55236 Overview
CVE-2025-55236 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Microsoft Windows Graphics Kernel. An authorized local attacker can win the race between validation and use of a kernel resource to execute arbitrary code in kernel context. The flaw affects supported editions of Windows 10, Windows 11, and Windows Server. Microsoft published the advisory on September 9, 2025 and released fixes through the Microsoft Security Response Center.
Critical Impact
Successful exploitation grants kernel-level code execution, enabling privilege escalation from a standard user to SYSTEM and full compromise of confidentiality, integrity, and availability on the affected host.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) — x86 and x64
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-55236 published to NVD
- 2025-09-09 - Microsoft released security patch through MSRC
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55236
Vulnerability Analysis
The vulnerability resides in the Windows Graphics Kernel, a privileged component that mediates GPU and display operations for user-mode processes. The defect is classified as [CWE-367] Time-of-Check Time-of-Use race condition. The kernel validates a resource or state, then uses it later without ensuring the state has not changed between the two operations. An attacker running code with standard user privileges can manipulate the shared resource during that window. Winning the race causes the kernel to operate on attacker-controlled data, resulting in local code execution at kernel privilege.
Root Cause
The root cause is a missing atomicity guarantee between a validation step and a subsequent use step on a shared kernel object. Because the check and the use are not held under a single synchronization primitive, a concurrent thread can modify the object after the check succeeds but before it is consumed. The Graphics Kernel then acts on unvalidated state, corrupting kernel memory or control flow.
Attack Vector
Exploitation requires local access and low-privilege authenticated code execution on the target host. No user interaction is required. An attacker typically triggers repeated Graphics Kernel operations from one thread while a second thread races to swap the underlying object or handle. Successful exploitation yields SYSTEM-level code execution, which adversaries chain with initial access techniques such as phishing, malicious installers, or post-exploitation footholds to move from user context to full host compromise.
No public proof-of-concept is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2025-55236 for authoritative technical details.
Detection Methods for CVE-2025-55236
Indicators of Compromise
- Unexpected dwm.exe or user-mode processes spawning SYSTEM-level child processes shortly after Graphics Kernel activity.
- Kernel bugchecks or Event ID 41 / 1001 crash entries referencing dxgkrnl.sys or win32kfull.sys on unpatched hosts.
- Presence of unsigned or newly dropped executables in %TEMP% or %APPDATA% immediately preceding privilege escalation events.
Detection Strategies
- Hunt for standard-user processes that suddenly execute with NT AUTHORITY\SYSTEM integrity without a legitimate elevation path.
- Correlate rapid, repeated GDI or DirectX API calls from a single non-graphical process with subsequent token manipulation events (Windows Event ID 4672 or 4624 type 2).
- Flag processes that create multiple threads racing on the same graphics handle followed by anomalous kernel-mode transitions.
Monitoring Recommendations
- Ingest Windows Security, System, and Sysmon logs into a centralized analytics platform and alert on kernel-mode crash clusters affecting dxgkrnl.sys.
- Monitor endpoint patch state to confirm the September 2025 cumulative update is installed on all Windows 10, Windows 11, and Windows Server hosts listed in the advisory.
- Track process lineage for local privilege escalation patterns following user-initiated executables.
How to Mitigate CVE-2025-55236
Immediate Actions Required
- Apply the September 2025 Microsoft security updates referenced in the MSRC advisory to every affected Windows and Windows Server build.
- Prioritize patching multi-user systems such as Remote Desktop Session Hosts, VDI pools, and developer workstations where low-privilege local access is common.
- Restrict the ability of untrusted users to execute arbitrary binaries on servers by enforcing application control policies such as Windows Defender Application Control or AppLocker.
Patch Information
Microsoft addressed CVE-2025-55236 in the September 9, 2025 security update cycle. Fixes are delivered through the standard Windows Update, Windows Server Update Services (WSUS), and Microsoft Update Catalog channels. Refer to the Microsoft Security Update CVE-2025-55236 for the specific KB article and build numbers that correspond to each supported Windows release.
Workarounds
- No official workarounds are published by Microsoft; patching is the only supported remediation.
- Reduce exposure by limiting interactive logon rights and removing unnecessary local accounts on high-value systems.
- Enforce least privilege and disable local script or binary execution for standard users until updates are deployed across the estate.
# Verify the patch level on a Windows host (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Query the current OS build to confirm it matches the patched build in the MSRC advisory
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
