CVE-2025-64661 Overview
CVE-2025-64661 is a race condition vulnerability in Windows Shell that allows an authorized local attacker to elevate privileges. The flaw stems from concurrent execution using a shared resource with improper synchronization, classified under [CWE-362]. Successful exploitation grants the attacker higher privileges on the affected Windows host, with impact to confidentiality, integrity, and availability. The vulnerability affects a wide range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server 2016 through Windows Server 2025. Microsoft published details through the Microsoft Security Response Center advisory.
Critical Impact
An authenticated local attacker who wins the race window can elevate to higher privileges on the host, gaining full control over confidentiality, integrity, and availability.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-64661 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64661
Vulnerability Analysis
The vulnerability resides in Windows Shell, a core component that handles user interface elements, file operations, and interaction with the operating system. Windows Shell processes shared resources without adequate synchronization primitives, creating a window where concurrent threads can interfere with privileged operations. An authorized local attacker can trigger this race condition to manipulate resource state between validation and use.
The scope is marked as changed, indicating that exploitation crosses a security boundary. A successful attacker gains elevated privileges from a low-privilege user context to a higher-privileged context on the local system. Attack complexity is elevated because the attacker must reliably win a timing-dependent race window, but no user interaction is required.
Root Cause
The root cause is improper synchronization of a shared resource accessed by concurrent threads inside Windows Shell. Because access checks and resource use are not atomic, the state of the shared resource can change between the two operations. This is a classic time-of-check to time-of-use (TOCTOU) pattern falling under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).
Attack Vector
Exploitation requires local access with valid low-privilege credentials on the target host. The attacker runs code that repeatedly invokes the affected Shell operation while a second thread mutates the shared resource. When the race is won, the privileged code operates on attacker-controlled state, resulting in privilege elevation. See the Microsoft Security Update advisory for vendor technical context.
Detection Methods for CVE-2025-64661
Indicators of Compromise
- Unexpected child processes spawned by explorer.exe or other Windows Shell host processes running under elevated tokens.
- New scheduled tasks, services, or persistence artifacts created shortly after low-privilege user logon.
- Anomalous handle activity or repeated rapid file system operations targeting Shell-related paths from a single non-privileged process.
Detection Strategies
- Monitor for local process token elevation events where the parent process is a standard-user Shell process.
- Baseline typical Shell process behavior and alert on tight loops of file, registry, or handle operations that resemble race-window brute forcing.
- Correlate Windows Event Log privilege assignment events (Event ID 4672) with the originating user session context.
Monitoring Recommendations
- Enable Sysmon Event ID 1 (process creation) and Event ID 10 (process access) with logging for Shell-related binaries.
- Ship endpoint telemetry to a centralized data lake and hunt for privilege escalation patterns following interactive user logons.
- Track patch compliance across all affected Windows client and server SKUs to identify unpatched systems.
How to Mitigate CVE-2025-64661
Immediate Actions Required
- Apply the December 2025 Microsoft security updates referenced in the MSRC advisory for CVE-2025-64661 on all affected Windows client and server systems.
- Prioritize patching of multi-user systems, jump hosts, and Remote Desktop Services servers where low-privilege users have interactive sessions.
- Restrict local logon rights on sensitive servers to reduce the population of accounts that can attempt local exploitation.
Patch Information
Microsoft has released security updates that address CVE-2025-64661 across all supported Windows versions listed in the affected products section. Administrators should deploy the corresponding cumulative update via Windows Update, WSUS, or Microsoft Update Catalog. Consult the Microsoft Security Update Guide entry for CVE-2025-64661 for the specific KB article that matches each Windows build.
Workarounds
- No official workaround has been published by Microsoft; installing the security update is the required remediation.
- Reduce exposure by enforcing least privilege, removing unnecessary interactive logon rights, and requiring application allow-listing for standard users.
- Segment untrusted user workloads onto dedicated hosts to limit the impact of local privilege escalation if patching is delayed.
# Verify installed update on Windows using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Force Windows Update scan and install
USOClient.exe StartScan
USOClient.exe StartDownload
USOClient.exe StartInstall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
