CVE-2025-30400

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free condition in Windows Desktop Window Manager. An attacker who already has the ability to run code on a Windows system can trigger unsafe reuse of freed memory in DWM-related components, potentially gaining higher privileges such as SYSTEM or another elevated security context. The flaw does not provide remote initial access by itself, but it is valuable as a post-compromise escalation primitive and has been confirmed as exploited in the wild.

Why it matters to the business

Successful exploitation can turn a limited user compromise into full control of an affected Windows endpoint or server, allowing attackers to disable security tools, dump credentials, install persistence, move laterally, and accelerate ransomware or data-theft operations. Because this vulnerability is in CISA KEV, has active in-the-wild exploitation, and had a federal remediation deadline of 2025-06-03, unpatched systems should be treated as high-priority exposure even though the EPSS score is relatively low.

How an attack unfolds

An attacker first obtains local code execution through phishing, malware, stolen credentials, exploitation of another vulnerability, or abuse of an exposed interactive session. They then run a local exploit that interacts with Windows graphical/session functionality handled by Desktop Window Manager. The exploit manipulates object lifetime and memory layout so that a freed DWM object is reused in an attacker-controlled way. If successful, the attacker corrupts memory to redirect execution or modify security-relevant state, resulting in an elevated process or token. The attacker can then perform privileged actions such as creating services, disabling endpoint protection, dumping credentials, adding accounts, or deploying additional payloads. Public reporting indicates active exploitation in the wild, so detection should assume this may be used as part of broader intrusion chains rather than as a standalone event.

How to fix it

Apply the Microsoft security update that fixes CVE-2025-30400 for all supported Windows versions, using the May 2025 Patch Tuesday cumulative update or any later cumulative update applicable to the affected operating system. Because no product-specific fixed build list was provided, validate exact KBs and build numbers against the Microsoft Security Update Guide for each Windows edition in use. Prioritize internet-accessible systems with interactive logon paths, VDI/RDS hosts, jump servers, administrator workstations, and endpoints used by privileged users. Where immediate patching is not possible, reduce risk by removing unnecessary local users, restricting interactive logon, enforcing least privilege, limiting RDP/remote access, enabling attack surface reduction rules, monitoring for local privilege escalation behavior, and isolating high-risk unpatched assets until updated.

How to confirm the fix worked

Confirm installation of the relevant Microsoft cumulative update or a later superseding update on every in-scope Windows system. Use centralized patch management, vulnerability scanning, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune compliance, or PowerShell inventory such as Get-HotFix and OS build checks to verify that the installed build is at or above the fixed level listed in the Microsoft Security Update Guide. Re-scan after patching to confirm the vulnerability is no longer reported. For high-risk systems, also review recent event logs and EDR telemetry for suspicious DWM crashes, unexpected privilege changes, service creation, scheduled task creation, or elevated process launches before declaring remediation complete.

Typical attack path

1. Gain initial local code execution on a Windows host using phishing, malware, stolen credentials, or another exploit.
2. Execute a local privilege escalation exploit targeting the Windows DWM use-after-free condition.
3. Trigger DWM memory corruption through crafted windowing, graphics, or session interactions.
4. Use heap grooming or memory manipulation to obtain control over freed/reused memory.
5. Escalate from a standard or low-privileged user context to an administrative or SYSTEM-level context.
6. Launch elevated tools or payloads to establish persistence, disable defenses, access credentials, or move laterally.

How to detect it

Look for evidence of local post-exploitation rather than relying on a single signature. Review Windows Application logs, Windows Error Reporting, Reliability Monitor, EDR telemetry, and crash dumps for abnormal dwm.exe or dwmcore.dll crashes, especially shortly before privilege changes or suspicious child activity elsewhere on the host. Correlate with Security logs for new logons, privilege assignment events, process creation, new services, scheduled tasks, local group membership changes, and attempts to disable security products. Useful Windows events include 4688 for process creation, 4672 for special privileges assigned to a new logon, 7045 for service installation, 4698 for scheduled task creation, 4720 for account creation, 4732 for local group membership changes, and 1102 for audit log clearing. In EDR/Sysmon, hunt for unknown executables launched from user-writable paths that are followed by elevated cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, schtasks.exe, sc.exe, net.exe, wmic.exe, or credential access tools. Because this is a local privilege escalation vulnerability, exploitation will usually appear as part of a larger intrusion chain; investigate nearby initial-access events and any subsequent persistence, defense evasion, credential dumping, or lateral movement.

• Faulting application name: dwm.exe
• Faulting module name: dwmcore.dll
• Desktop Window Manager
• Windows Error Reporting
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Event ID 4698
• Event ID 4720
• Event ID 4732
• Event ID 1102
• \Windows\System32\dwm.exe
• \Windows\System32\dwmcore.dll
• sc.exe create
• schtasks.exe /Create
• net localgroup administrators
• wevtutil cl
• vssadmin delete shadows

What your security team should do

• Patch all affected Windows systems immediately with the May 2025 or later cumulative security update; the KEV remediation deadline has already passed.
• Prioritize endpoints and servers where users can run code interactively, including administrator workstations, VDI/RDS infrastructure, jump hosts, and systems used for remote administration.
• Hunt for signs of prior exploitation, especially DWM crashes followed by elevated process creation, new services, new scheduled tasks, credential dumping behavior, or security tool tampering.
• Correlate local privilege escalation indicators with initial access events such as suspicious email execution, web downloads, RDP logons, VPN logons, and malware alerts.
• Ensure EDR prevention is enabled for privilege escalation, credential theft, process injection, suspicious service creation, and tampering behaviors.
• Restrict standard users from local administrative privileges and review local Administrators group membership across Windows fleets.
• For systems that cannot be patched promptly, isolate them, restrict interactive access, and increase monitoring until remediation is complete.