CVE-2025-64658 Overview
CVE-2025-64658 is a race condition vulnerability in Windows Shell that allows an authorized local attacker to elevate privileges. The flaw involves concurrent execution using a shared resource without proper synchronization [CWE-362]. An attacker with low-privilege local access can exploit the timing window to obtain elevated privileges on the target system.
Microsoft published the vulnerability on December 9, 2025, as part of its security update guide. The issue affects a broad range of supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2019 through 2025.
Critical Impact
Successful exploitation grants high impact to confidentiality, integrity, and availability, with a scope change that extends the attacker's reach beyond the initially vulnerable component.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-64658 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64658
Vulnerability Analysis
CVE-2025-64658 is a race condition [CWE-362] in the Windows Shell component. The Shell subsystem provides the user interface and integration layer for interacting with the operating system, including file operations, shortcuts, and shell extensions. The flaw arises when multiple threads or processes access a shared resource without adequate locking, creating a Time-of-Check to Time-of-Use (TOCTOU) window.
An attacker with local access and low privileges can time operations to interfere with a higher-privileged Shell action. Successful exploitation elevates privileges on the affected host. The vulnerability requires user interaction and exhibits high attack complexity, reflecting the timing precision needed to win the race.
The scope change indicates that exploitation impacts resources beyond the vulnerable Shell process. This typically means the attacker can affect components running under a different security authority, such as SYSTEM.
Root Cause
The root cause is improper synchronization when Windows Shell accesses a shared resource under concurrent execution. Without atomic checks or exclusive locking, the state of the resource can change between validation and use, allowing an attacker to substitute attacker-controlled data or paths at the critical moment.
Attack Vector
Exploitation requires local access, low privileges, and user interaction. An attacker triggers a Shell operation and races a parallel process that manipulates the shared resource during the vulnerable window. Winning the race redirects the privileged Shell action against attacker-controlled targets, yielding privilege escalation.
No public proof-of-concept is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2025-64658 advisory for vendor guidance.
Detection Methods for CVE-2025-64658
Indicators of Compromise
- Unexpected child processes spawned by explorer.exe or Shell handler processes with elevated tokens.
- File system activity showing rapid create, rename, or symbolic link operations targeting paths used by Shell operations.
- Local user accounts performing actions inconsistent with their assigned privilege level shortly after Shell-driven file operations.
Detection Strategies
- Monitor for processes that manipulate junctions, symbolic links, or hard links immediately before or during Shell operations.
- Correlate token elevation events (Event ID 4672) with preceding low-privilege process activity from the same user session.
- Baseline normal Shell extension load behavior and alert on anomalous DLLs loaded by explorer.exe or related Shell hosts.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging to capture race condition exploit primitives.
- Ingest Sysmon events for file creation, process access, and image load into a centralized SIEM for correlation.
- Track failed and successful privilege escalation attempts across endpoints and prioritize hosts running unpatched Windows builds.
How to Mitigate CVE-2025-64658
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-64658 to all affected Windows and Windows Server systems.
- Prioritize patching multi-user systems such as Remote Desktop Session Hosts, VDI, and shared workstations.
- Audit local account membership and remove unnecessary interactive logon rights from standard users.
Patch Information
Microsoft has released security updates that address the race condition in Windows Shell. Administrators should consult the Microsoft Security Update Guide entry for CVE-2025-64658 for the specific KB articles that apply to each affected build.
Workarounds
- Restrict interactive local logon on servers and reduce the number of accounts with local sign-in rights.
- Enforce application allowlisting through Windows Defender Application Control or AppLocker to limit which binaries a low-privileged user can execute.
- Enable enhanced auditing on Shell-adjacent directories such as user profile folders and Temp paths to increase detection fidelity until patches are applied.
# Verify the installed Windows build and patch level
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, WindowsProductName
# List installed security updates to confirm the Shell patch is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
