CVE-2025-55245: Xbox Gaming Services Privilege Escalation

CVE-2025-55245 Overview

CVE-2025-55245 is a local privilege escalation vulnerability in Microsoft Xbox Gaming Services. The flaw stems from improper link resolution before file access, classified under [CWE-59]. An authorized attacker with local access can leverage symbolic or hard link manipulation to redirect privileged file operations performed by the Xbox Gaming Services component. Successful exploitation allows the attacker to elevate privileges on the affected Windows system.

Microsoft published the advisory on September 9, 2025. The vulnerability affects installations of Xbox Gaming Services on Windows endpoints where the component is present.

Critical Impact
A local, authenticated attacker can abuse link following in Xbox Gaming Services to gain elevated privileges, leading to full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Xbox Gaming Services (all versions prior to the September 2025 patched release)
Windows endpoints with Xbox Gaming Services installed via the Microsoft Store
Windows systems where the GamingServices and GamingServicesNet services run with elevated privileges

Discovery Timeline

2025-09-09 - CVE-2025-55245 published to NVD
2025-09-09 - Microsoft releases security update guidance
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55245

Vulnerability Analysis

The vulnerability resides in how Xbox Gaming Services handles file paths before performing privileged file operations. The service resolves paths without adequately validating whether the target is a symbolic link, junction, or hard link. A local user can plant a link at a location the service later accesses under SYSTEM context.

When the service follows the attacker-controlled link, it performs the intended operation on a file chosen by the attacker rather than the expected target. This link-following behavior maps to [CWE-59] Improper Link Resolution Before File Access.

Exploitation requires local access and low-privileged authenticated user rights. No user interaction is needed beyond the attacker's own actions. Successful exploitation grants high impact to confidentiality, integrity, and availability on the host.

Root Cause

The root cause is missing or insufficient link validation in file operations performed by Xbox Gaming Services. The service should canonicalize paths and reject reparse points before opening files with elevated privileges. Without these checks, attackers redirect writes, deletes, or permission changes to arbitrary locations, including protected system directories.

Attack Vector

An attacker begins with a standard user session on a Windows host running Xbox Gaming Services. The attacker creates a symbolic link, mount point, or NTFS junction in a directory the service monitors or writes to. The attacker then triggers the service action that causes it to operate on the crafted path. The service, running as SYSTEM, follows the link and modifies a file the attacker could not otherwise touch, resulting in privilege escalation.

No public proof-of-concept exploit is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.414%.

See the Microsoft Security Update Guide for CVE-2025-55245 for vendor technical details.

Detection Methods for CVE-2025-55245

Indicators of Compromise

Creation of symbolic links, junctions, or hard links by non-administrative users in directories accessed by GamingServices.exe or GamingServicesNet.exe
Unexpected file writes or ACL changes in protected paths such as C:\Program Files\WindowsApps or C:\Windows\System32 correlated with Xbox Gaming Services activity
New or modified files under %ProgramData%\Microsoft\XboxLive or %LOCALAPPDATA%\Packages\Microsoft.GamingServices_* with mismatched owners

Detection Strategies

Monitor process behavior of GamingServices.exe for file operations that traverse reparse points originating from user-writable directories
Alert on mklink command execution or CreateSymbolicLink API calls by low-privileged users targeting service-controlled paths
Correlate Windows Event ID 4663 (object access) with SYSTEM writes to files owned by standard users

Monitoring Recommendations

Enable Sysmon file-create and file-create-stream-hash events for paths used by Xbox Gaming Services
Track token elevation events (Event ID 4672) tied to GamingServices child processes
Baseline expected file operations of Xbox Gaming Services and flag deviations, particularly file deletions or overwrites outside its package directory

How to Mitigate CVE-2025-55245

Immediate Actions Required

Apply the Microsoft security update for CVE-2025-55245 through the Microsoft Store or Windows Update on all affected endpoints
Verify Xbox Gaming Services is updated to the patched version by checking the package version in the Microsoft Store app
Remove Xbox Gaming Services from systems that do not require it, particularly enterprise workstations and servers
Audit local user creation of symbolic links and restrict the SeCreateSymbolicLinkPrivilege right where not required

Patch Information

Microsoft addressed CVE-2025-55245 in the September 2025 update to Xbox Gaming Services. The update is distributed automatically through the Microsoft Store. Administrators should confirm deployment on managed endpoints. Reference the Microsoft Security Update Guide entry for CVE-2025-55245 for the fixed version details.

Workarounds

Uninstall Xbox Gaming Services on hosts where gaming functionality is not needed using Get-AppxPackage Microsoft.GamingServices | Remove-AppxPackage
Restrict local logon rights to reduce the population of users capable of exploiting the flaw
Enforce Group Policy to remove SeCreateSymbolicLinkPrivilege from standard users on managed endpoints

bash

# Verify installed Xbox Gaming Services version on Windows (PowerShell)
Get-AppxPackage -Name Microsoft.GamingServices | Select-Object Name, Version, PackageFullName

# Remove Xbox Gaming Services if not required
Get-AppxPackage -AllUsers Microsoft.GamingServices | Remove-AppxPackage -AllUsers

# Audit users holding SeCreateSymbolicLinkPrivilege
secedit /export /cfg C:\secpol.cfg
Select-String -Path C:\secpol.cfg -Pattern 'SeCreateSymbolicLinkPrivilege'