What is the CVSS score of EUVD-2025-17772?

EUVD-2025-17772 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Windows are affected by EUVD-2025-17772?

CVE-2025-33071 is a critical remote code execution vulnerability in Windows KDC Proxy Service (KPSSVC) affecting Active Directory environments.. A patch is available.

How to fix or mitigate EUVD-2025-17772?

Within 24 hours: Identify and inventory all Windows servers running KPSSVC (typically domain controllers and KDC proxy hosts) using network scanning or Active Directory queries. Within 7 days: Apply vendor-released patch to all affected systems, prioritizing domain controllers and external-facing KDC proxies; restart services post-patch and validate Kerberos authentication functionality. Within 30 days: Confirm patch deployment across all systems via configuration management tools; review authentication logs for exploitation attempts (failed Kerberos pre-authentication or unusual KDC proxy traffic) and update intrusion detection signatures.

Windows EUVD-2025-17772

| CVE-2025-33071 HIGH

Use After Free (CWE-416)

2025-06-10 secure@microsoft.com

Windows RCE Use After Free Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:41 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.25398.1665,10.0.14393.8148,10.0.17763.7434

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17772

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:22 nvd

HIGH 8.1

DescriptionCVE.org

Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Use-after-free memory corruption vulnerability in Windows KDC Proxy Service (KPSSVC) that allows unauthenticated network attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability affects Windows systems running the Kerberos KDC Proxy Service and represents a critical remote code execution risk in Active Directory environments. While specific KEV/POC status and EPSS scores are not provided in the source data, the network attack vector combined with high CVSS 8.1 score and remote code execution capability indicates this is a significant priority for organizations relying on Windows authentication infrastructure.

Technical ContextAI

The KDC Proxy Service (KPSSVC) is a Windows component that provides a proxy interface for Kerberos Key Distribution Center (KDC) communications, commonly used in enterprise Active Directory deployments to facilitate Kerberos authentication across network boundaries and firewalls. The vulnerability is rooted in CWE-416 (Use After Free), a memory safety issue where freed memory is accessed after deallocation, potentially allowing attackers to read/write sensitive data or redirect code execution. The use-after-free occurs within the KPSSVC request processing logic, likely in buffer handling or object lifecycle management during Kerberos proxy protocol operations. An attacker can trigger the vulnerability by sending specially crafted network packets that cause premature object deallocation followed by dereferencing, corrupting the heap and achieving code execution in the context of the KPSSVC process (typically SYSTEM privilege on Windows).

RemediationAI

Immediate actions: (1) Apply Microsoft security patch immediately upon release - monitor Microsoft Security Response Center (MSRC) for CVE-2025-33071 KB article; (2) If patching is delayed, disable or restrict network access to KDC Proxy Service ports (typically TCP/UDP 88 for Kerberos, proxy-specific ports per configuration) using firewall rules, limiting exposure to trusted networks only; (3) Implement network segmentation to isolate KDC proxy infrastructure from untrusted zones; (4) Monitor for exploitation attempts targeting KPSSVC process crashes or unusual authentication failures in event logs (Security and System logs, Event ID 4768/4769 for Kerberos events); (5) Escalate patching priority for externally-facing KDC proxy servers in DMZ or hybrid AD scenarios; (6) Once patch is available, test in lab environment before production deployment due to authentication criticality. Vendor advisory links and specific KB numbers will be published by Microsoft - check https://msrc.microsoft.com/ for CVE-2025-33071.