CVE-2025-58722: Windows 10 1607 Privilege Escalation Flaw

CVE-2025-58722 Overview

CVE-2025-58722 is a heap-based buffer overflow [CWE-122] in the Windows Desktop Window Manager (DWM). An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on October 14, 2025, and rates the issue as high severity. The vulnerability affects a broad set of currently supported Windows versions, from Windows 10 1607 through Windows 11 25H2, and from Windows Server 2016 through Windows Server 2025. Successful exploitation compromises confidentiality, integrity, and availability on the target host.

Critical Impact

A local attacker with low privileges can corrupt DWM heap memory to gain elevated privileges, enabling full system compromise on unpatched Windows endpoints and servers.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (22H2, 23H2, 24H2, 25H2)
• Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2025-10-14 - CVE-2025-58722 published to NVD and Microsoft advisory released
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58722

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in Windows Desktop Window Manager (DWM). DWM (dwm.exe) is the compositor service responsible for rendering the Windows graphical user interface. It runs with elevated privileges and receives input from lower-privileged user sessions.

An authorized local attacker can send crafted data to DWM that causes an out-of-bounds write on the heap. The overflow corrupts adjacent heap structures, which can be leveraged to hijack control flow or manipulate privileged objects. Because DWM operates in a privileged context, successful exploitation results in local elevation of privilege from a standard user to SYSTEM-level capabilities.

The attack requires prior authenticated access to the target and no user interaction. It cannot be launched remotely across a network.

Root Cause

The root cause is improper bounds checking on a heap-allocated buffer within a DWM code path. Insufficient validation of attacker-controlled size or offset values allows data to be written beyond the allocated region, corrupting heap metadata or adjacent objects.

Attack Vector

Exploitation requires local access with low privileges. The attacker executes code in a standard user context and interacts with DWM through supported interfaces to trigger the vulnerable code path. No user interaction is required. The vulnerability is scored with an EPSS probability of 2.108% (80th percentile) as of the most recent data, indicating elevated exploitation likelihood relative to the general CVE population.

No public proof-of-concept exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of writing.

Detection Methods for CVE-2025-58722

Indicators of Compromise

• Unexpected crashes or restarts of dwm.exe on user endpoints or Remote Desktop hosts, particularly on unpatched builds.
• Windows Error Reporting entries referencing heap corruption or access violations in dwm.exe or associated graphics modules.
• New processes spawned with SYSTEM-level tokens shortly after anomalous DWM activity from a standard user session.

Detection Strategies

• Monitor for abnormal child processes or token manipulation originating from dwm.exe and correlate against user session context.
• Track process crashes for DWM across the fleet and alert on clusters of crashes on unpatched hosts.
• Deploy behavioral EDR rules that flag local elevation-of-privilege patterns, including unexpected impersonation and privileged handle acquisition from standard user processes.

Monitoring Recommendations

• Enable Windows security auditing for privilege use and process creation with command-line logging.
• Ingest endpoint telemetry into a centralized data lake or SIEM to correlate DWM crashes with subsequent privileged actions across sessions.
• Prioritize monitoring on multi-user systems such as Remote Desktop Session Hosts and Virtual Desktop Infrastructure, where local EoP has the highest blast radius.

How to Mitigate CVE-2025-58722

Immediate Actions Required

• Apply the October 2025 Microsoft security updates that address CVE-2025-58722 on all affected Windows 10, Windows 11, and Windows Server systems.
• Prioritize patching on multi-tenant hosts such as Remote Desktop, Citrix, and VDI servers where multiple low-privileged users share a system.
• Audit local account access and remove unnecessary interactive logon rights to reduce the pool of users capable of exploiting a local flaw.

Patch Information

Microsoft has published patches through the Microsoft CVE-2025-58722 Advisory. Administrators should consult the advisory for the exact KB article and cumulative update applicable to each Windows version and deploy through Windows Update, WSUS, Microsoft Intune, or an equivalent patch management workflow.

Workarounds

• No official workaround is documented by Microsoft; applying the security update is the required remediation.
• Enforce least privilege and application allowlisting to limit the ability of untrusted binaries to reach the vulnerable DWM code path.
• Restrict interactive and Remote Desktop access to trusted administrative users until affected systems are patched.

# Verify installed update status on Windows hosts (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20