CVE-2025-62466 Overview
CVE-2025-62466 is a null pointer dereference vulnerability in the Windows Client-Side Caching (CSC) Service. An authorized local attacker can trigger the flaw to elevate privileges on the affected host. Microsoft classifies the issue as high severity with a CVSS 3.1 base score of 7.8. The weakness maps to [CWE-476] (NULL Pointer Dereference) and impacts a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2008 through 2025.
Critical Impact
A local, authenticated attacker can dereference a null pointer inside the CSC Service to gain elevated privileges, with full impact to confidentiality, integrity, and availability on the affected system.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-62466 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62466
Vulnerability Analysis
The Client-Side Caching (CSC) Service supports Windows Offline Files, allowing users to cache network share content locally. The service runs with elevated privileges and processes requests from local user context. CVE-2025-62466 is a null pointer dereference inside this service. A local, authenticated attacker who can interact with the CSC Service can trigger a code path that operates on an uninitialized or unvalidated pointer. Successful exploitation gives the attacker code execution in a higher-privileged context, resulting in local privilege escalation.
Root Cause
The root cause is missing validation of a pointer before dereference inside the CSC Service, consistent with [CWE-476]. When the service processes attacker-influenced input along a specific path, it fails to confirm that an internal pointer references a valid object. The subsequent dereference produces an exploitable condition rather than a benign crash, enabling privilege escalation instead of only denial of service.
Attack Vector
Exploitation requires local access and low privileges. No user interaction is needed. The attacker interacts with the CSC Service through its exposed local interfaces, such as control operations tied to Offline Files, to reach the vulnerable code path. Because the service handles caching on behalf of higher-privileged components, controlling execution flow yields elevated rights on the host. Public exploit code is not currently listed, the vulnerability is not in the CISA KEV catalog, and the EPSS probability is low.
No verified proof-of-concept code is publicly available. See the Microsoft CVE-2025-62466 Advisory for vendor technical details.
Detection Methods for CVE-2025-62466
Indicators of Compromise
- Unexpected crashes, restarts, or Windows Error Reporting entries for the CSC Service (CscService) or the cscsvc.dll module on affected hosts.
- Creation of new local administrator accounts, scheduled tasks, or services shortly after CSC Service faults appear in the System event log.
- Anomalous child processes spawned under service host processes (svchost.exe) that host the CSC Service.
Detection Strategies
- Alert on repeated Service Control Manager events indicating CSC Service termination or unexpected state transitions on endpoints and servers.
- Correlate CSC Service crashes with subsequent token manipulation, new privileged process creation, or lateral movement activity from the same session.
- Hunt for local, low-privileged users invoking Offline Files functionality followed by immediate elevation-of-privilege behavior.
Monitoring Recommendations
- Ingest Windows Security, System, and Application logs into a centralized platform and retain sufficient history to correlate service faults with follow-on activity.
- Monitor Sysmon Event ID 1 (process creation) and Event ID 10 (process access) for suspicious access to svchost.exe instances hosting the CSC Service.
- Track patch deployment status for all supported Windows client and Windows Server versions listed in Microsoft's advisory.
How to Mitigate CVE-2025-62466
Immediate Actions Required
- Apply Microsoft's December 2025 security updates that address CVE-2025-62466 across all affected Windows client and Windows Server versions.
- Prioritize patching multi-user systems, jump hosts, and Remote Desktop Session Hosts where local privilege escalation impact is highest.
- Audit local accounts, privileged group membership, and scheduled tasks on previously unpatched systems to identify any post-exploitation persistence.
Patch Information
Microsoft has released security updates for all supported affected products. Refer to the Microsoft CVE-2025-62466 Advisory for the specific KB articles, build numbers, and download links that apply to each Windows version.
Workarounds
- Where Offline Files functionality is not required, disable the Client-Side Caching feature through Group Policy under Computer Configuration > Administrative Templates > Network > Offline Files.
- Restrict interactive and remote interactive logon rights on sensitive systems to reduce the pool of users able to reach the vulnerable local attack surface.
- Enforce application allowlisting and least privilege on endpoints so that unauthorized binaries cannot be executed by low-privileged users seeking to exploit the CSC Service.
# Configuration example: disable Offline Files via registry (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\CSC" /v Start /t REG_DWORD /d 4 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetCache" /v Enabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
