Windscribe VPN CVE-2025-65199

Exploitation requires an existing local account on the Linux host that is a member of the 'windscribe' group; the attacker then calls the privileged helper's 'changeMTU' function and supplies a malicious 'adapterName' value containing shell metacharacters, which the helper runs as root. Limiting factors: no network vector (local access mandatory), the account must belong to the windscribe group (a non-default privilege granted by installing/using the client), and the CVSS 4.0 AT:P flag indicates an additional attack requirement must be satisfied. Only Windscribe for Linux Desktop builds prior to v2.18.3-alpha / v2.18.8 are affected.

This is a local privilege escalation via OS command injection (CWE-78), not a remotely exploitable flaw. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) confirms the attacker must already have local access AND be a member of the privileged 'windscribe' group, with an additional attack requirement (AT:P) that likely reflects a timing/environmental precondition. All three impact metrics are High (VC:H/VI:H/VA:H) because successful exploitation yields arbitrary command execution as root - a full compromise of the host. The vendor CVSS 4.0 score of 7.3 is a fair reflection: high technical impact but meaningfully gated by the local-access and group-membership prerequisites. EPSS is 1.25% (68th percentile) - modest, consistent with a local-only bug that cannot be mass-scanned or wormed. There is NO CISA KEV listing, so despite a public exploit write-up existing, there is no evidence of active exploitation. Signals are internally consistent: this is a genuine root-privilege-escalation issue worth patching on any Linux host running the affected Windscribe client, but the local + group-membership gating keeps it below the priority of a network-facing unauthenticated flaw. No conflicting data was identified; the CVSS vector and description agree that access is local.

An attacker who already has a foothold as an unprivileged local user that belongs to the 'windscribe' group invokes the helper's 'changeMTU' function and injects shell metacharacters through the 'adapterName' parameter, which is passed unsanitized into a command executed as root. A public exploit/write-up (hackingbydoing) documents the technique, lowering the bar for a working local privilege-escalation to root. Because the vector is local (AV:L) this cannot be triggered remotely and requires prior access to the machine and group membership.