Microsoft has disclosed a critical vulnerability in Windows Remote Desktop Services (RDS) that could allow authorized attackers to escalate privileges on affected systems.
See also: Microsoft Patch Tuesday November 2025: Fixes 63 vulnerabilities
The flaw, tracked as CVE-2025-60703, stems from an unreliable pointer dereference interrupt, a classic memory safety issue that has plagued software for years and carries a severity rating of “Important” from the company.
The vulnerability affects the Windows RDS kernel, a widely used protocol for remote access to Windows computers. According to Microsoft's advisory, a local, authorized attacker could exploit this vulnerability to gain elevated privileges, potentially reaching SYSTEM level access. This means that a user with standard credentials on a compromised computer could bypass security checks and execute arbitrary code with administrative privileges.
While the problem requires local authentication, it poses a serious risk in multi-user environments, such as corporate networks or shared servers, where insider threats or rootkits (such as via electronic “phishing”) are common.
Technically, CVE-2025-60703 falls under the category of CWE-822: Untrusted Pointer Dereference, where software fails to validate a pointer before dereferencing it, leading to possible memory corruption.
See also: Vulnerability in NVIDIA App for Windows allows code execution
Microsoft classifies the exploit as "Unlikely" at this stage, with no public disclosure or evidence of active exploitation. The CVSS score, which comes directly from Microsoft, highlights its importance without escalating to critical, likely due to the local attack vector.
The affected versions span multiple versions of Windows, including Windows 10, 11, and Server versions with RDS-enabled components built into post-pandemic remote work settings.
Microsoft is urging immediate patching, with updates rolling out via Windows Update. Organizations that rely on RDS for virtual desktop infrastructure (VDI) or remote management should prioritize deployment.
As an additional precaution, experts recommend enforcing least privilege principles, monitoring for unusual privilege escalations, and segmenting networks to limit lateral movement.
This revelation comes amid an increase in threats targeting Windows, including recent zero-day vulnerabilities in other Microsoft products. While not yet weaponized, CVE-2025-60703 serves as a reminder of the ongoing challenges to the security of remote access protocols.
See also: Vulnerability in Windows Cloud Files Mini Filter is being actively exploited
Security teams are advised to fully review Microsoft advisory and test patches in staging environments to avoid disruptions.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
