CVE-2025-60717: Windows 10 1809 Use After Free Vulnerability

CVE-2025-60717 Overview

CVE-2025-60717 is a use-after-free vulnerability [CWE-416] in the Windows Broadcast DVR User Service. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. Microsoft has assigned the issue a CVSS 3.1 base score of 7.0 with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw affects multiple supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2019 through 2025.

Critical Impact
Successful exploitation lets a low-privileged local user gain higher privileges on the affected host, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2019, Server 2022 23H2, and Server 2025

Discovery Timeline

2025-11-11 - CVE-2025-60717 published to the National Vulnerability Database
2025-11-11 - Microsoft published the Security Update Guide entry for CVE-2025-60717
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-60717

Vulnerability Analysis

The Broadcast DVR User Service (BcastDVRUserService) handles game recording and broadcasting sessions on a per-user basis. The service manages objects tied to session state and capture pipelines. A use-after-free condition occurs when the service references memory that has already been released. An authenticated local attacker with the ability to interact with the service can drive it into the vulnerable state and reuse the freed allocation.

Because the service runs with elevated privileges relative to a standard interactive user, controlled reuse of the dangling pointer allows the attacker to execute code or corrupt state in that higher-privilege context. The CVSS vector indicates high attack complexity, which typically reflects the need to win a timing window or arrange specific object layout before the reuse occurs.

Root Cause

The root cause is improper lifetime management of a heap-allocated object within the Broadcast DVR User Service. The service releases the object while another code path retains a reference. Subsequent use of the stale reference dereferences memory that an attacker can reclaim and populate with attacker-controlled data.

Attack Vector

Exploitation requires local access and low-privileged authentication. No user interaction is required. The attacker triggers the vulnerable code path in the service, races the free with a controlled allocation, and then invokes the operation that dereferences the freed object. Microsoft has not published exploit code, and no public proof-of-concept is available at this time. Technical specifics are limited to the vendor advisory; see the Microsoft Security Update Guide for CVE-2025-60717.

Detection Methods for CVE-2025-60717

Indicators of Compromise

Unexpected crashes or restarts of BcastDVRUserService recorded in the Windows Application or System event logs.
New child processes or token manipulations spawned from svchost.exe hosting the Broadcast DVR User Service.
Elevation of a standard user account to SYSTEM or higher-integrity context shortly after Broadcast DVR activity.

Detection Strategies

Monitor for anomalous process lineage where svchost.exe hosting BcastDVRUserService spawns interactive or scripting binaries such as cmd.exe, powershell.exe, or rundll32.exe.
Alert on Windows Error Reporting entries and crash dumps referencing the Broadcast DVR User Service module.
Correlate local privilege changes with recent invocations of Game DVR or Game Bar features from standard user accounts.

Monitoring Recommendations

Enable Sysmon Event IDs 1, 10, and 25 to capture process creation, process access, and process tampering targeting svchost.exe service groups.
Ingest Windows Security and Application logs into a centralized data lake for cross-host correlation of service crashes and token elevations.
Baseline normal Broadcast DVR activity per host and alert on deviations, particularly on servers where the feature should be inactive.

How to Mitigate CVE-2025-60717

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2025-60717 across all affected Windows 10, Windows 11, and Windows Server builds.
Prioritize patching on multi-user systems such as Remote Desktop Session Hosts and Virtual Desktop Infrastructure hosts where local users can reach the service.
Audit local account membership and remove unnecessary interactive logon rights from servers.

Patch Information

Microsoft addresses CVE-2025-60717 through the November 2025 monthly security update. Refer to the Microsoft Security Update Guide for CVE-2025-60717 for the KB article corresponding to each affected build. Install the cumulative update through Windows Update, Windows Server Update Services, or your enterprise patch management platform.

Workarounds

Where the Game DVR feature is not required, disable it through Group Policy or the registry value HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR\AllowGameDVR = 0.
On server workloads, confirm that the BcastDVRUserService is not running and restrict installation of the Media Foundation and Desktop Experience features when not required.
Enforce least privilege and remove standard users from systems that do not require interactive access until patches are deployed.

bash

# Configuration example: disable Game DVR via registry (run elevated)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f