EUVD-2025-17772Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Use-after-free memory corruption vulnerability in Windows KDC Proxy Service (KPSSVC) that allows unauthenticated network attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. The vulnerability affects Windows systems running the Kerberos KDC Proxy Service and represents a critical remote code execution risk in Active Directory environments. While specific KEV/POC status and EPSS scores are not provided in the source data, the network attack vector combined with high CVSS 8.1 score and remote code execution capability indicates this is a significant priority for organizations relying on Windows authentication infrastructure.
Technical ContextAI
The KDC Proxy Service (KPSSVC) is a Windows component that provides a proxy interface for Kerberos Key Distribution Center (KDC) communications, commonly used in enterprise Active Directory deployments to facilitate Kerberos authentication across network boundaries and firewalls. The vulnerability is rooted in CWE-416 (Use After Free), a memory safety issue where freed memory is accessed after deallocation, potentially allowing attackers to read/write sensitive data or redirect code execution. The use-after-free occurs within the KPSSVC request processing logic, likely in buffer handling or object lifecycle management during Kerberos proxy protocol operations. An attacker can trigger the vulnerability by sending specially crafted network packets that cause premature object deallocation followed by dereferencing, corrupting the heap and achieving code execution in the context of the KPSSVC process (typically SYSTEM privilege on Windows).
RemediationAI
Immediate actions: (1) Apply Microsoft security patch immediately upon release - monitor Microsoft Security Response Center (MSRC) for CVE-2025-33071 KB article; (2) If patching is delayed, disable or restrict network access to KDC Proxy Service ports (typically TCP/UDP 88 for Kerberos, proxy-specific ports per configuration) using firewall rules, limiting exposure to trusted networks only; (3) Implement network segmentation to isolate KDC proxy infrastructure from untrusted zones; (4) Monitor for exploitation attempts targeting KPSSVC process crashes or unusual authentication failures in event logs (Security and System logs, Event ID 4768/4769 for Kerberos events); (5) Escalate patching priority for externally-facing KDC proxy servers in DMZ or hybrid AD scenarios; (6) Once patch is available, test in lab environment before production deployment due to authentication criticality. Vendor advisory links and specific KB numbers will be published by Microsoft - check https://msrc.microsoft.com/ for CVE-2025-33071.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today