CVE-2025-65199 Overview
CVE-2025-65199 is a command injection vulnerability [CWE-78] in the Windscribe for Linux Desktop App. A local user who belongs to the windscribe group can execute arbitrary commands as root through the adapterName parameter of the changeMTU function. The flaw exists because the parameter is passed unsanitized to a shell context invoked by the privileged Windscribe helper service. Windscribe fixed the issue in v2.18.3-alpha and v2.18.8.
Critical Impact
A local attacker in the windscribe group can escalate privileges to root on any affected Linux host, resulting in complete system compromise.
Affected Products
- Windscribe for Linux Desktop App versions prior to v2.18.3-alpha
- Windscribe for Linux Desktop App v2.18.1-alpha
- Windscribe for Linux Desktop App v2.18.3 and v2.18.5
Discovery Timeline
- 2025-12-10 - CVE-2025-65199 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-65199
Vulnerability Analysis
The Windscribe Linux Desktop App ships with a privileged helper process that runs as root and accepts IPC requests from the unprivileged client. Users placed in the windscribe group are authorized to send these requests. One of the exposed operations, changeMTU, modifies the Maximum Transmission Unit of a network adapter by invoking a system command that references the caller-supplied adapterName. The application passes adapterName into the command string without sanitization or argument-array execution. An attacker can embed shell metacharacters in adapterName to append arbitrary commands that the helper then executes as root. Because the privileged boundary is crossed inside the helper, the injected commands inherit the helper's root context, converting membership in the windscribe group into full local privilege escalation.
Root Cause
The root cause is unsafe construction of an operating system command from untrusted input, classified under [CWE-78] (OS Command Injection). The changeMTU handler concatenates the adapterName value into a shell-evaluated command instead of using a fixed argv list or validating that the value matches a real interface name.
Attack Vector
Exploitation requires local access and membership in the windscribe group. The attacker sends a crafted changeMTU IPC request whose adapterName field contains shell payload characters such as ;, |, or $(). The helper process invokes the constructed command as root, executing the injected commands. Technical exploitation notes are available in the Windscribe VPN Local Privilege Escalation write-up and the Windscribe Desktop-App v2.18.2 to v2.18.3 diff.
Detection Methods for CVE-2025-65199
Indicators of Compromise
- Unexpected root-owned processes spawned as children of the Windscribe helper service on Linux hosts.
- Shell metacharacters (;, &&, |, `, $()) present in adapterName values within Windscribe helper logs or IPC traces.
- New setuid binaries, cron entries, or SSH keys created shortly after Windscribe helper activity by accounts in the windscribe group.
Detection Strategies
- Hunt process ancestry where the Windscribe helper (running as root) executes sh, bash, ip, or ifconfig with arguments containing shell metacharacters.
- Correlate windscribe group membership changes with subsequent privileged command execution on the same host.
- Alert on Windscribe application versions below v2.18.3-alpha or v2.18.8 reported by asset inventory.
Monitoring Recommendations
- Forward auditd execve telemetry from Linux endpoints running Windscribe and monitor for root-context children of the helper daemon.
- Track membership of the windscribe local group and flag additions outside change control.
- Review Windscribe helper logs for malformed adapter names or MTU change requests originating from non-administrative users.
How to Mitigate CVE-2025-65199
Immediate Actions Required
- Upgrade Windscribe for Linux Desktop App to v2.18.3-alpha or v2.18.8 or later on all affected endpoints.
- Audit the windscribe group and remove any accounts that do not require VPN control privileges.
- Investigate hosts running vulnerable versions for signs of prior local privilege escalation.
Patch Information
Windscribe addressed the command injection in the changeMTU handler in Windscribe Desktop App v2.18.3-alpha and v2.18.8. The upstream code changes are visible in the official v2.18.2 to v2.18.3 diff and the Windscribe Desktop-App repository. See also the CVE-2025-65199 CVE record and the CISA CSAF advisory.
Workarounds
- Restrict the windscribe group to trusted administrative users until the patch is deployed.
- Uninstall the Windscribe Linux Desktop App on multi-user systems where VPN client functionality is not required.
- Enforce mandatory access controls (AppArmor or SELinux) around the Windscribe helper binary to limit which commands it can execute.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
