CVE-2025-68623: DirectX Runtime Privilege Escalation Flaw

CVE-2025-68623 Overview

A privilege escalation vulnerability exists in Microsoft DirectX End-User Runtime Web Installer version 9.29.1974.0 that allows a low-privilege user to achieve SYSTEM-level access through executable file replacement during the installation process. The vulnerability stems from improper access control (CWE-284) in how the installer handles downloaded files in user-writable directories.

During the installation process, the installer operates with HIGH integrity privileges and downloads executables and DLLs to the %TEMP% folder, which is writable by standard users. An attacker can exploit this by replacing the downloaded executable with a malicious payload before it is executed by the installer with elevated privileges. This creates a complete privilege escalation chain from standard user to SYSTEM, as code running at HIGH integrity can escalate to SYSTEM level by registering and executing a service.

Critical Impact

Local attackers with low-privilege access can escalate to SYSTEM-level privileges by exploiting the insecure handling of downloaded executables during DirectX installation.

Affected Products

• Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0

Discovery Timeline

• 2026-03-11 - CVE CVE-2025-68623 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-68623

Vulnerability Analysis

This vulnerability represents a classic Time-of-Check Time-of-Use (TOCTOU) race condition combined with improper access control during the installation workflow. The core issue lies in the trust boundary violation where the installer, running with HIGH integrity, downloads and subsequently executes files from a location (%TEMP%) that is writable by the very users it is meant to elevate privileges from.

The attack is particularly dangerous because it does not require network access or complex exploitation techniques. A local user with standard privileges can simply monitor the %TEMP% directory for newly downloaded installation executables and replace them before the installer executes them. The installer's failure to verify the integrity of the downloaded files before execution creates a trivial escalation path.

It should be noted that Microsoft has disputed this vulnerability, stating this is "behavior as designed." However, this design allows complete privilege escalation from standard user to SYSTEM, making it a significant security concern in enterprise environments where least-privilege principles are enforced.

Root Cause

The root cause is improper access control (CWE-284) in the installation process. The installer fails to implement adequate protections when handling downloaded files:

1. Insecure Temporary Storage: Downloads are placed in %TEMP%, which is user-writable
2. Missing Integrity Verification: No cryptographic verification of downloaded files before execution
3. Privilege Inheritance: Downloaded files are executed with the installer's HIGH integrity level
4. No Directory Isolation: The installer does not use a protected, system-controlled directory for staging

Attack Vector

The attack follows a local exploitation path that requires low privileges and no user interaction:

1. A low-privilege attacker initiates or waits for a DirectX installation to begin
2. The installer downloads executables to the %TEMP% folder with HIGH integrity
3. The attacker monitors the %TEMP% directory for the downloaded executable files
4. Before the installer executes the downloaded file, the attacker replaces it with a malicious executable
5. The installer executes the replaced file with HIGH integrity privileges
6. The malicious code, now running with HIGH integrity, registers and starts a service to achieve SYSTEM privileges

The exploitation is straightforward since the %TEMP% folder permissions allow any user to modify files within their profile. The race condition window between download and execution provides sufficient time for file replacement.

Detection Methods for CVE-2025-68623

Indicators of Compromise

• Suspicious executable file modifications in user %TEMP% directories during DirectX installation processes
• Unexpected service registrations occurring immediately after DirectX installation attempts
• Process execution chains showing DirectX installer launching non-Microsoft executables with elevated privileges
• File system events indicating rapid write-delete-write operations on downloaded installer components

Detection Strategies

• Monitor for file replacement activity in %TEMP% folders during installation processes using file integrity monitoring
• Implement behavioral detection for privilege escalation patterns involving installer processes executing untrusted binaries
• Configure endpoint detection to alert on service creation events originating from user-space processes that were spawned by installation utilities
• Use application whitelisting to prevent execution of unsigned binaries from temporary directories

Monitoring Recommendations

• Enable Windows Security Event logging for service creation (Event ID 7045) and process creation (Event ID 4688) with command-line auditing
• Deploy Sysmon to capture detailed file creation, modification, and process execution telemetry in user temporary directories
• Configure alerts for DirectX installation processes (dxwebsetup.exe) spawning child processes from writable directories
• Monitor for anomalous privilege token changes during installation workflows

How to Mitigate CVE-2025-68623

Immediate Actions Required

• Avoid running Microsoft DirectX End-User Runtime Web Installer version 9.29.1974.0 on systems where untrusted users have interactive access
• Run installations from isolated administrator sessions where standard users cannot access the %TEMP% directory
• Consider using offline/standalone DirectX installation packages instead of the web installer
• Implement application control policies to restrict executable launches from %TEMP% directories

Patch Information

As of the last modified date, Microsoft has disputed this vulnerability as "behavior as designed." No official patch is currently available. Organizations should consult the Microsoft Download Resource for any updates to the DirectX installer.

Additional technical details are available in the Talos Intelligence Report TALOS-2025-2293.

Workarounds

• Use alternative installation methods such as offline DirectX redistributables that do not download executables to user-writable locations
• Configure Group Policy to restrict program execution from %TEMP% directories using Software Restriction Policies or AppLocker
• Perform DirectX installations from dedicated administrator accounts in isolated sessions where the user %TEMP% directory is not accessible to standard users
• Implement file integrity monitoring on installation staging directories to detect unauthorized modifications

# AppLocker rule to block execution from user TEMP directories
# Run in elevated PowerShell to create deny rule
New-AppLockerPolicy -RuleType Path -Path "%TEMP%\*" -Action Deny -User "Everyone"