Windows EUVD-2025-17772

This vulnerability presents elevated real-world risk despite moderate CVSS complexity (AC:H). Key risk signals: (1) Network-accessible attack surface (AV:N) with no authentication required (PR:N), making it broadly exploitable; (2) High CVSS subscore impact (C:H/I:H/A:H) indicates complete system compromise; (3) The KDC Proxy Service is commonly deployed in enterprise environments, multiplying exposure; (4) Attack complexity is HIGH, suggesting exploitation requires specific conditions (packet crafting, timing, memory layout knowledge), which slightly reduces opportunistic exploit likelihood but does not eliminate sophisticated threat actor capabilities; (5) Absence of provided EPSS/KEV data limits probability assessment, but the combination of remote code execution + Kerberos infrastructure criticality suggests high priority. Organizations should treat this as a critical vulnerability for systems in AD-dependent environments, particularly in DMZs or exposed KDC proxy deployments. The HIGH complexity may slow mass exploitation but should not delay patching.

An attacker on a network segment with access to a Windows KDC Proxy Service (e.g., internet-exposed proxy server in a hybrid AD environment, or internal attacker with network access) crafts a series of specially-formatted Kerberos proxy protocol packets designed to trigger a use-after-free condition in KPSSVC's memory management. By sending packets with malformed Kerberos request structures, incorrect buffer length fields, or race-condition-triggering sequences, the attacker causes the service to free an object but continue referencing it in subsequent operations. The attacker leverages knowledge of Windows heap layout and KPSSVC internals to corrupt freed memory structures or redirect function pointers, achieving arbitrary code execution in the SYSTEM context. Once code execution is achieved, the attacker can: escalate privileges (already SYSTEM), extract cached Kerberos credentials, create backdoors, or pivot to other AD systems. High attack complexity (AC:H) means the attack likely requires: heap spray techniques, precise timing, or specific OS versions/configurations, but skilled APT actors routinely overcome such barriers. No public POC is assumed in this analysis due to lack of reference data, but the vulnerability profile (remote RCE in auth infrastructure) suggests it will attract advanced threat actors and may be subject to coordinated disclosure before patch release.