CVE-2025-59191 Overview
CVE-2025-59191 is a heap-based buffer overflow vulnerability in the Windows Connected Devices Platform Service (Cdpsvc). An authenticated local attacker can trigger the flaw to corrupt heap memory and elevate privileges on the affected host. Microsoft addressed the issue in the October 2025 security update cycle.
The vulnerability affects a broad range of currently supported Windows client and server releases, including Windows 10, Windows 11 through 25H2, and Windows Server 2019 through 2025. The weakness is categorized under [CWE-122: Heap-based Buffer Overflow].
Critical Impact
Successful exploitation lets a low-privileged local user gain SYSTEM-level privileges, providing full control over the compromised Windows host.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-10-14 - CVE-2025-59191 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59191
Vulnerability Analysis
The Connected Devices Platform Service (Cdpsvc) coordinates cross-device experiences such as Nearby Sharing, Phone Link, and shared clipboard scenarios on Windows. It runs as a service with elevated privileges and processes messages from local, low-privileged clients through inter-process communication.
CVE-2025-59191 is a heap-based buffer overflow that occurs when Cdpsvc handles attacker-controlled input on the service side. Writing past the bounds of a heap-allocated buffer allows overwriting adjacent memory structures, which can be leveraged to hijack execution flow or overwrite security-relevant pointers within the service process.
Because the service operates at a higher privilege level than the caller, corrupting its memory yields a local privilege escalation primitive that maps cleanly to the MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).
Root Cause
The root cause is insufficient bounds validation on data placed into a heap buffer inside Cdpsvc. When a request contains a length or field size that exceeds the allocated destination buffer, the service copies more data than the buffer can hold, corrupting adjacent heap chunks and metadata.
Attack Vector
Exploitation requires local access and valid credentials on the target host. The attacker interacts with the running Cdpsvc instance through its exposed local interface, sends a crafted message that triggers the overflow, and manipulates the corrupted heap state to redirect execution or tamper with privileged data. Remote and unauthenticated attacks are not applicable, since the attack vector is local and requires prior authentication.
No public proof-of-concept or exploitation in the wild has been reported at the time of writing. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-59191
Indicators of Compromise
- Unexpected crashes, restarts, or Windows Error Reporting entries for the CDPSvc service on the affected host.
- Creation of new local accounts, services, or scheduled tasks by processes that were spawned as children of svchost.exe hosting CDPSvc.
- Anomalous loading of unsigned or unusual DLLs into the svchost.exe instance hosting CDPSvc.
Detection Strategies
- Monitor Windows Event Log entries in System and Application channels for Service Control Manager events referencing CDPSvc faults or restarts.
- Alert on process creation events (Event ID 4688 or Sysmon Event ID 1) where the parent is the svchost.exe hosting CDPSvc and the child process is a shell, script interpreter, or LOLBAS binary.
- Correlate local logon events for standard users with subsequent SYSTEM-context activity on the same host within a short time window.
Monitoring Recommendations
- Enable command-line auditing and PowerShell script block logging on all Windows hosts to capture post-exploitation behavior.
- Track patch state for the October 2025 Windows security updates across Windows 10, Windows 11, and Windows Server fleets.
- Baseline normal behavior for CDPSvc and alert on deviations such as elevated CPU, memory growth, or repeated crashes.
How to Mitigate CVE-2025-59191
Immediate Actions Required
- Apply the October 2025 Microsoft security updates that address CVE-2025-59191 on all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching on multi-user systems, jump hosts, and Remote Desktop Session hosts where low-privileged users have interactive access.
- Audit local account access and remove unnecessary interactive logon rights to reduce the pool of users able to exploit the flaw.
Patch Information
Microsoft published fixes through the Microsoft Security Response Center. Refer to the Microsoft Security Update CVE-2025-59191 advisory for KB article numbers per Windows build and deploy them through Windows Update, WSUS, Microsoft Update Catalog, or your endpoint management platform.
Workarounds
- No official workaround has been published by Microsoft; patching is the supported remediation path.
- If patching must be delayed, evaluate disabling the Connected Devices Platform Service (CDPSvc) on systems that do not require cross-device features, after testing for functional impact on Nearby Sharing and Phone Link.
- Restrict interactive and Remote Desktop logon to trusted administrative users on unpatched hosts to limit exposure to local attackers.
# Example: query and disable Cdpsvc where cross-device features are not required
sc.exe query CDPSvc
sc.exe config CDPSvc start= disabled
sc.exe stop CDPSvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
