CVE-2025-60703: Windows 10 1607 Privilege Escalation Flaw

CVE-2025-60703 Overview

CVE-2025-60703 is a local privilege escalation vulnerability in the Windows Remote Desktop component. The flaw stems from an untrusted pointer dereference [CWE-822] that an authorized local attacker can trigger to elevate privileges on affected Windows systems. Microsoft published the advisory on November 11, 2025, and the issue affects a broad set of Windows client and server releases from Windows Server 2008 through Windows 11 25H2 and Windows Server 2025. The vulnerability requires local access and low privileges, but no user interaction, and successful exploitation compromises confidentiality, integrity, and availability of the host.

Critical Impact
An authenticated local attacker can dereference an attacker-controlled pointer inside the Remote Desktop code path to gain elevated privileges on the target Windows host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-11-11 - CVE-2025-60703 published to NVD
2025-11-11 - Microsoft releases security update for CVE-2025-60703
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60703

Vulnerability Analysis

The vulnerability is classified as an untrusted pointer dereference [CWE-822] in Windows Remote Desktop. The affected code path accepts a pointer value that originates from, or can be influenced by, a lower-privileged context and dereferences it without validating that the pointer references a trusted memory region. When the Remote Desktop component operates at a higher privilege level than the caller, the attacker can steer the dereference to attacker-controlled memory and hijack execution flow inside the privileged process.

Exploitation is local and requires authentication on the target system, but does not require user interaction. Successful exploitation yields elevated privileges on the local host, enabling the attacker to run code in the security context of the vulnerable Remote Desktop service.

Root Cause

The root cause is missing or insufficient validation of a pointer used by Windows Remote Desktop before it is dereferenced. Because the pointer value is not verified to reference a legitimate, trusted object owned by the higher-privilege component, an attacker who controls the pointer's source can direct the read or write to memory of their choosing, corrupting privileged state or diverting control flow.

Attack Vector

The attack vector is local. An attacker who already has a low-privileged foothold on a Windows host with the Remote Desktop component present can interact with the vulnerable interface to supply a crafted pointer value. The dereference occurs in the privileged process, and after successful exploitation the attacker executes code at the elevated privilege level associated with that component. See the Microsoft Security Update CVE-2025-60703 advisory for vendor-provided technical details.

Detection Methods for CVE-2025-60703

Indicators of Compromise

Unexpected crashes, exceptions, or restarts of Windows Remote Desktop-related services on hosts that have not been patched.
New or unfamiliar processes spawned as SYSTEM or another elevated context immediately after Remote Desktop-related activity from a standard user session.
Local user accounts gaining membership in privileged groups without a corresponding administrative change ticket.

Detection Strategies

Correlate Windows Event Logs for service faults in Remote Desktop components with subsequent process creation events (Event ID 4688) that show privilege elevation from a standard user context.
Hunt for suspicious child processes of Remote Desktop service binaries, particularly command interpreters (cmd.exe, powershell.exe) or LOLBins launched with SYSTEM tokens.
Baseline normal Remote Desktop service behavior on servers and workstations and alert on deviations such as unusual module loads or memory access patterns.

Monitoring Recommendations

Enable and forward Sysmon process creation, image load, and process access events from all hosts running Remote Desktop services.
Monitor Windows Defender / EDR telemetry for behavioral alerts related to token manipulation, integrity level changes, or unexpected privilege assignments.
Track patch state for CVE-2025-60703 across the estate and alert on hosts that remain unpatched after the maintenance window.

How to Mitigate CVE-2025-60703

Immediate Actions Required

Apply the November 2025 Microsoft security updates that address CVE-2025-60703 to all affected Windows client and server versions.
Prioritize patching on multi-user systems, Remote Desktop Session Hosts, jump servers, and any host reachable by standard user accounts.
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of users able to attempt local exploitation.

Patch Information

Microsoft has released security updates for all affected Windows versions. Refer to the Microsoft Security Update CVE-2025-60703 advisory for the specific KB numbers and package downloads applicable to each supported build. Deploy the updates through Windows Update, WSUS, Microsoft Update Catalog, or your enterprise patch management tooling and reboot systems to complete installation.

Workarounds

Restrict local logon rights on affected hosts to only trusted administrative personnel until patches are deployed.
Where feasible, disable Remote Desktop services on systems that do not require them, reducing exposure of the vulnerable component.
Enforce least privilege on standard user accounts and remove local administrator rights that are not strictly required for business function.

bash

# Verify that the November 2025 security update is installed on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Disable the Remote Desktop service where it is not required (run elevated)
Set-Service -Name TermService -StartupType Disabled
Stop-Service -Name TermService -Force