CVE-2025-62572 Overview
CVE-2025-62572 is an out-of-bounds read vulnerability in the Microsoft Windows Application Information Service (AIS). The flaw allows an authorized local attacker to elevate privileges on affected systems. Microsoft assigned this issue a CVSS 3.1 base score of 7.8 and categorized it under [CWE-125]. The vulnerability affects Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Exploitation requires prior local access with low privileges but no user interaction. A successful attack yields high impact to confidentiality, integrity, and availability. Microsoft published the advisory on December 9, 2025.
Critical Impact
An authenticated local attacker can leverage the out-of-bounds read in AppInfo to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025 hosts.
Affected Products
- Microsoft Windows 11 24H2
- Microsoft Windows 11 25H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-62572 published to NVD
- 2025-12-09 - Microsoft releases security update via Microsoft Vulnerability Advisory CVE-2025-62572
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62572
Vulnerability Analysis
The vulnerability resides in the Application Information Service (appinfo.dll), the Windows component that brokers elevation requests through User Account Control (UAC). AIS runs as a SYSTEM service and processes elevation metadata supplied by client processes. An out-of-bounds read in this service allows an attacker to access memory beyond an allocated buffer during request processing.
Attackers can combine the disclosed memory contents with additional primitives to bypass mitigations such as Address Space Layout Randomization (ASLR) or corrupt subsequent state. The result is local privilege escalation from a standard user account to SYSTEM. Because AIS is a core UAC component, the attack surface is present on every affected desktop and server SKU.
Root Cause
The defect is classified as [CWE-125] Out-of-Bounds Read. The service does not correctly validate the length or offset of a field before reading from an internal buffer. When a crafted request is submitted through the AIS interprocess communication channel, the read operation extends past the bounds of the allocated structure.
Attack Vector
Exploitation is local. The attacker must already hold an authenticated session with low privileges on the target host. No user interaction is required. The attacker triggers the vulnerable code path by issuing a malformed elevation request or elevation-related RPC call to AIS. Because the service runs as SYSTEM and handles requests from unprivileged clients, the boundary between user and kernel-adjacent trust levels is where the flaw is abused.
No public proof-of-concept exploit has been published. The EPSS model currently rates near-term exploitation probability as low, but local privilege escalation flaws in UAC components are historically incorporated into post-compromise tooling.
Detection Methods for CVE-2025-62572
Indicators of Compromise
- Unexpected crashes or restarts of the AppInfo service in the System event log.
- New SYSTEM-level processes spawned as children of svchost.exe hosting appinfo.
- Standard user sessions issuing repeated UAC elevation requests followed by anomalous token elevation events.
Detection Strategies
- Monitor Windows Event ID 7031 or 7034 for repeated failures of the Application Information service.
- Correlate process creation events (Sysmon Event ID 1) where a low-integrity parent spawns a high-integrity child outside expected administrative workflows.
- Baseline elevation activity per user account and alert on outliers, particularly on Windows Server 2025 hosts where interactive UAC use is uncommon.
Monitoring Recommendations
- Ingest Sysmon, Windows Security, and System logs into a central data lake for cross-host correlation.
- Track privilege-token modification events (Event ID 4703) originating from non-administrative users.
- Alert on service crashes in appinfo.dll paired with subsequent privileged process creation within a short time window.
How to Mitigate CVE-2025-62572
Immediate Actions Required
- Apply the December 2025 Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2025-62572 to all Windows 11 24H2, 25H2, and Windows Server 2025 systems.
- Inventory affected hosts using configuration management tooling and prioritize multi-user servers and developer workstations.
- Restrict interactive logon rights on servers to reduce the population of authenticated local users who can reach the vulnerable code path.
Patch Information
Microsoft addressed CVE-2025-62572 through cumulative updates published on the Microsoft Security Response Center advisory. Administrators should validate that the December 2025 or later cumulative update is installed on each affected build. Verify installation state through Get-HotFix or the Windows Update history.
Workarounds
- No official workaround has been published by Microsoft; patching is the supported remediation.
- Enforce the principle of least privilege so that non-administrative accounts cannot execute arbitrary binaries that could invoke crafted elevation requests.
- Enable attack surface reduction rules and application allowlisting through Windows Defender Application Control to limit which processes can call into AIS.
# Verify the December 2025 cumulative update is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Confirm the Application Information service is running and up to date
Get-Service -Name Appinfo
(Get-Item C:\Windows\System32\appinfo.dll).VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
