CVE-2025-60707 Overview
CVE-2025-60707 is a use-after-free vulnerability [CWE-416] in the Windows Multimedia Class Scheduler Service (MMCSS). The flaw allows a locally authenticated attacker to elevate privileges on affected systems. Microsoft published the advisory on November 11, 2025, and the issue affects multiple supported versions of Windows 10, Windows 11, and Windows Server. The vulnerability carries a CVSS v3.1 score of 7.8 and requires low privileges to exploit without user interaction. Successful exploitation can yield SYSTEM-level access, giving attackers full control of the compromised host.
Critical Impact
Local authenticated attackers can trigger a use-after-free in MMCSS to elevate privileges and gain SYSTEM-level code execution on Windows and Windows Server systems.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-11-11 - CVE-2025-60707 published to NVD and included in Microsoft's Patch Tuesday advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60707
Vulnerability Analysis
The Multimedia Class Scheduler Service (MMCSS) is a Windows system service that prioritizes CPU scheduling for time-sensitive multimedia workloads such as audio and video playback. MMCSS runs within a shared svchost.exe process and exposes interfaces callable by local user processes. This vulnerability arises from improper handling of object lifetime inside MMCSS, resulting in a use-after-free condition [CWE-416]. An authenticated local user can invoke MMCSS in a specific sequence that causes the service to reference a freed memory object. Because MMCSS operates at a higher privilege level than the calling process, a successful exploit yields privilege escalation to SYSTEM.
Root Cause
The root cause is a use-after-free defect in MMCSS object management. The service releases a kernel or process-level object while another code path retains a dangling reference to it. When the freed memory is reallocated with attacker-controlled data, the subsequent dereference operates on the crafted content, enabling control of execution flow or protected data structures within the privileged service.
Attack Vector
Exploitation requires local access with valid credentials. The attacker executes code on the target host as a standard user, then interacts with MMCSS APIs in a manner that triggers the freed-object reuse. No user interaction is required beyond the attacker's own actions. See the Microsoft CVE-2025-60707 Update Guide for vendor detail. Technical detection and mitigation references are available from the Vicarius Detection Script and the Vicarius Mitigation Script.
No public proof-of-concept code is available at this time. Refer to the vendor advisory for authoritative technical details.
Detection Methods for CVE-2025-60707
Indicators of Compromise
- Unexpected child processes spawned by svchost.exe hosting the MMCSS service group.
- Local user processes performing unusual token duplication or impersonation shortly after interacting with MMCSS.
- Crash dumps or Windows Error Reporting events referencing the MMCSS service or mmcss.dll with access-violation exceptions.
- New SYSTEM-level processes launched by an interactive or standard user session.
Detection Strategies
- Monitor for anomalous IPC and RPC calls from low-privilege user sessions targeting MMCSS interfaces.
- Baseline the parent-child relationships of the svchost.exe instance hosting MMCSS and alert on deviations.
- Correlate local logons followed by SYSTEM-context process creation within a short time window.
Monitoring Recommendations
- Enable Windows Security event auditing for privilege use (Event IDs 4672, 4673, 4688) with command-line logging.
- Ingest Sysmon Event ID 1 (process creation) and Event ID 10 (process access) to detect handle abuse against MMCSS.
- Track service crash and restart events (Event IDs 7031, 7034) referencing the MMCSS service.
How to Mitigate CVE-2025-60707
Immediate Actions Required
- Apply the November 2025 Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching of multi-user systems, terminal servers, and virtual desktop infrastructure where local users are present.
- Restrict interactive logon rights and remove unnecessary local user accounts on servers.
- Audit installed software for third-party tools that require MMCSS scheduling and validate their update posture.
Patch Information
Microsoft addressed CVE-2025-60707 in its November 11, 2025 Patch Tuesday release. Consult the Microsoft CVE-2025-60707 Update Guide for the specific KB article and cumulative update that applies to each affected Windows build. Deploy the updates through Windows Update, Windows Server Update Services (WSUS), or Microsoft Configuration Manager and confirm installation using Get-HotFix or the corresponding management console.
Workarounds
- No official workaround is provided by Microsoft; applying the security update is the supported remediation.
- Reduce exposure by enforcing least-privilege access and blocking untrusted code execution on endpoints where the patch cannot be applied immediately.
- Use application control policies such as Windows Defender Application Control (WDAC) or AppLocker to prevent execution of unapproved binaries by standard users.
# Verify patch installation on Windows systems
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Check the running MMCSS service status
Get-Service -Name MMCSS | Format-List *
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
