CVE-2025-60719: Windows 10 1607 Privilege Escalation Flaw

CVE-2025-60719 Overview

CVE-2025-60719 is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). The flaw is an untrusted pointer dereference [CWE-822] that allows an authenticated local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on November 11, 2025, and the vulnerability affects nearly the full supported Windows client and server lineup, including Windows 10, Windows 11 24H2/25H2, and Windows Server 2008 through Windows Server 2025.

Critical Impact
A successful exploit lets a low-privileged local user gain SYSTEM-level code execution, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-11-11 - CVE-2025-60719 published to NVD and Microsoft advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60719

Vulnerability Analysis

The vulnerability resides in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver that services Winsock user-mode socket operations through IOCTL requests. The driver dereferences a pointer whose value can be influenced by an unprivileged caller. Because afd.sys executes in kernel context, dereferencing attacker-controlled memory can lead to arbitrary kernel read, write, or code execution primitives.

Exploitation requires local access and valid credentials on the target machine. The attack complexity is high, indicating that a working exploit likely depends on race conditions, precise memory layout preparation, or specific system state. A successful exploit grants elevated privileges typically at the SYSTEM level, enabling full host compromise.

Root Cause

The root cause is classified as an untrusted pointer dereference [CWE-822]. The driver accepts input from user mode and uses that input, directly or indirectly, as a pointer without validating that it references a safe kernel object. When the driver dereferences that pointer, memory access occurs at an attacker-influenced address, corrupting kernel state or diverting control flow.

Attack Vector

An authenticated attacker running unprivileged code on the target host issues crafted IOCTL requests to \\Device\\Afd through the Winsock API. The malicious request supplies a pointer or offset value that the driver later dereferences without proper validation. The attacker leverages the resulting kernel primitive to overwrite a token, hijack a kernel object, or execute payloads with SYSTEM privileges. Refer to the Microsoft Security Update CVE-2025-60719 advisory for vendor-specific technical details.

Detection Methods for CVE-2025-60719

Indicators of Compromise

Unexpected creation of SYSTEM-owned processes spawned from user-context parent processes such as cmd.exe, powershell.exe, or custom binaries in user-writable paths.
New or unsigned binaries opening handles to \Device\Afd shortly before privilege transitions.
Kernel crashes or afd.sys bugchecks that precede suspicious authentication or service creation events.

Detection Strategies

Monitor for anomalous IOCTL activity targeting afd.sys from processes that do not typically perform low-level socket operations.
Correlate unexpected token duplication or process-integrity elevations against the invoking user context using EDR telemetry.
Alert on process-tree anomalies where a non-elevated parent produces an elevated child without a legitimate elevation mechanism such as UAC or a service host.

Monitoring Recommendations

Enable Windows Kernel-Mode auditing and forward Sysmon Event IDs 1 (process create) and 10 (process access) to your SIEM.
Track patch state across the fleet and flag hosts that remain on pre-November 2025 cumulative updates.
Baseline normal use of Winsock IOCTLs per endpoint role and alert on statistical deviations.

How to Mitigate CVE-2025-60719

Immediate Actions Required

Apply the November 2025 Microsoft security updates that address CVE-2025-60719 to all affected Windows client and server systems.
Prioritize patching multi-user hosts, terminal servers, and jump boxes where low-privileged users can execute code.
Restrict interactive and remote logon rights on high-value systems to reduce the pool of potential local attackers.

Patch Information

Microsoft released cumulative updates that remediate the untrusted pointer dereference in afd.sys. Consult the Microsoft Security Update CVE-2025-60719 advisory for the specific KB article and build numbers corresponding to each supported Windows version.

Workarounds

No vendor-supplied workaround is documented; applying the security update is the required remediation.
As a compensating control, enforce application allowlisting to prevent execution of unauthorized binaries that could stage the exploit.
Apply the principle of least privilege and remove standard-user accounts from systems that do not require interactive local sessions.

bash

# Verify installation of the November 2025 security update on Windows
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2025-11-11') } | Sort-Object InstalledOn -Descending

# Enumerate systems missing the update via WSUS/SCCM or PowerShell remoting
Invoke-Command -ComputerName (Get-Content .\hosts.txt) -ScriptBlock {
    Get-HotFix -Id KB5000000 -ErrorAction SilentlyContinue
}