CVE-2025-60720: Windows 10 1607 Privilege Escalation Flaw

CVE-2025-60720 Overview

CVE-2025-60720 is a buffer over-read vulnerability in the Windows Transport Driver Interface Extension (TDX.sys) kernel driver. An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows systems. Microsoft published the advisory on November 11, 2025, covering client and server editions from Windows Server 2008 through Windows Server 2025 and Windows 10 through Windows 11 25H2. The issue is tracked under CWE-126: Buffer Over-read and carries a CVSS 3.1 score of 7.8. No public proof-of-concept exploit is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation allows a low-privileged local user to read out-of-bounds kernel memory and elevate privileges to SYSTEM on unpatched Windows hosts.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-11-11 - CVE-2025-60720 published to the National Vulnerability Database
2025-11-11 - Microsoft released security advisory and patch guidance
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60720

Vulnerability Analysis

The vulnerability resides in TDX.sys, the Windows kernel-mode driver that implements the legacy Transport Driver Interface Extension (TDX) used by network transport components. A buffer over-read condition occurs when the driver reads past the intended end of an input or internal buffer while processing attacker-influenced data. Because TDX.sys runs in kernel mode, memory disclosed or manipulated through the flaw resides in a highly privileged execution context. An attacker able to invoke the vulnerable code path from user mode can leak sensitive kernel memory contents, defeat kernel address space layout randomization (KASLR), or chain the primitive with additional flaws to gain SYSTEM-level code execution.

Root Cause

The root cause is improper bounds validation classified under CWE-126: Buffer Over-read. The driver processes a caller-supplied buffer or length field without verifying that read operations remain within the allocated region. When the boundary check is missing or incorrectly computed, subsequent read operations traverse adjacent kernel memory before returning results to the caller or using the data in further processing.

Attack Vector

Exploitation requires local access and low-privilege authentication on the target host. The attack complexity is low and no user interaction is needed. An attacker executes code as a standard user, opens a handle to a device or transport object serviced by TDX.sys, and issues crafted requests that trigger the over-read. Because the vulnerability produces impacts across confidentiality, integrity, and availability, it is a viable second-stage primitive for malware, initial-access brokers, or post-exploitation frameworks that have already landed a foothold and require SYSTEM privileges. See the Microsoft CVE-2025-60720 Advisory for the authoritative technical description.

Detection Methods for CVE-2025-60720

Indicators of Compromise

Unexpected user-mode processes opening handles to TDX device objects such as \Device\Tdx outside of normal networking stack activity.
Kernel bug checks referencing TDX.sys (for example, SYSTEM_SERVICE_EXCEPTION or KERNEL_MODE_HEAP_CORRUPTION) on systems missing the November 2025 update.
Sudden token duplication or SYSTEM-privileged child processes spawned from low-integrity parents.

Detection Strategies

Hunt for standard-user processes issuing NtDeviceIoControlFile or NtCreateFile calls against TDX transport device paths, which are uncommon for typical applications.
Correlate local logon events (Event ID 4624 type 2/10) with subsequent privilege elevation events (Event ID 4672) originating from the same session.
Monitor Windows Error Reporting for repeated crashes involving TDX.sys, which can indicate exploit development or unstable exploitation attempts.

Monitoring Recommendations

Enable kernel driver load auditing and alert on unsigned or unexpected drivers loaded shortly after suspicious user-mode activity.
Ingest Sysmon Event ID 1 (process create) and Event ID 10 (process access) into a central analytics platform to baseline access to kernel device objects.
Track deployment status of the November 2025 Microsoft security update across the fleet and alert on hosts that remain unpatched.

How to Mitigate CVE-2025-60720

Immediate Actions Required

Apply the Microsoft November 2025 security updates referenced in the Microsoft CVE-2025-60720 Advisory to all affected Windows client and server builds.
Prioritize patching multi-user systems, terminal servers, and jump hosts where low-privileged local access is expected.
Restrict interactive and remote desktop logon rights to trusted administrators until patches are validated in production.

Patch Information

Microsoft addressed the vulnerability in the security updates released on November 11, 2025. Administrators should consult the Microsoft Security Response Center guidance for the specific KB article numbers per Windows build and deploy them through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

No official workaround has been published by Microsoft; installing the security update is the supported remediation.
Reduce exposure by enforcing the principle of least privilege and removing unnecessary local accounts from affected hosts.
Enable Microsoft Defender Attack Surface Reduction rules and Credential Guard to raise the cost of chaining this primitive with credential theft techniques.

bash

# Verify installation status of the security update on a Windows host
# Replace KBxxxxxxx with the KB number listed in the MSRC advisory for the specific build
wmic qfe get HotFixID,InstalledOn | findstr /I "KBxxxxxxx"

# PowerShell equivalent
Get-HotFix | Where-Object { $_.HotFixID -eq "KBxxxxxxx" }