CVE-2025-47987

CVE-2025-47987: Windows CredSSP Elevation of Privilege

📌 This repository contains documentation and analysis resources about the vulnerability CVE-2025-47987, a heap-based buffer overflow flaw affecting the Windows Credential Security Support Provider (CredSSP) protocol.

---

📝 Description

The vulnerability allows an authenticated local attacker to elevate their privileges on the system. The flaw originates from improper memory management when processing specific CredSSP protocol packets, which can lead to:

• A heap-based buffer overflow
• Or an integer overflow (Integer Overflow)

Identifier: CVE-2025-47987
Vulnerability Type: Elevation of Privilege (EoP)
Weaknesses (CWE):

• CWE-122: Heap-based Buffer Overflow
• CWE-190: Integer Overflow or Wraparound
  Severity (CVSS 3.1): 7.8 HIGH
  Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

---

💻 Affected Systems

The vulnerability affects a wide range of Microsoft operating systems, including:

• Windows 10 (versions 1507 through 22H2)
• Windows 11 (versions 22H2, 23H2, and 24H2)
• Windows Server: 2008, 2012, 2016, 2019, 2022, 2025

✅ Critical Note: An update to a build version later than those indicated in the Microsoft Security Update Guide is required to mitigate the risk.

🔍 See the full list of affected CPEs below.

---

🛠️ Mitigation and Solution

✅ Main Solution:

Apply the official security patches distributed by Microsoft through Windows Update.

• Official Update: Microsoft Security Update Guide — CVE-2025-47987
• Post-patch Verification: Run winver or systeminfo and confirm that the build version exceeds the thresholds listed above.

⚠️ There are no effective workarounds (such as disabling CredSSP), as it would affect critical functionalities like Remote Desktop, WinRM, and PowerShell Remoting.

---

🔍 Technical Analysis

The overflow occurs within the Credential Security Support Provider (CredSSP), specifically during the processing of NTLM/Kerberos authentication structures in the context of credential delegation (credential delegation).

Key Points:

• Required Access: Local + authenticated (not remote).
• User Interaction: UI:N → No interaction required.
• Impact: Total compromise of Confidentiality, Integrity, and Availability (C:H/I:H/A:H).
• Typical scenario: An attacker with standard user privileges sends a malicious request to a service using CredSSP (e.g., termsrv, lsass), corrupting the heap and achieving code execution with SYSTEM privileges.

---

⚠️ Disclaimer

This content is provided for informational and cybersecurity research purposes only.

❌ Using this information to compromise systems without explicit authorization is illegal and violates international laws (e.g., CFAA, Organic Law on Data Protection, GDPR, etc.).

✅ Legitimate uses include: authorized audits, ethical penetration testing, defense development, IDS/EDR detection, and supervised academic training.

Official Sources:

• NIST National Vulnerability Database — CVE-2025-47987
• Microsoft Security Response Center (MSRC)

---

📚 Known Affected Software Configurations (CPE 2.2)

📣 Missing a CPE? Report your finding to [email protected] (authorized researchers only)!

---

📎 References

• Microsoft Security Advisory — CVE-2025-47987 (Vendor Advisory)
• NVD — CVE-2025-47987 Detail
• CWE-122: Heap-based Buffer Overflow
• CWE-190: Integer Overflow or Wraparound

---

🔐 Last updated: 2025-04-05 — Based on public data from MSRC and NVD.
🛠️ This README.md file is licensed under CC BY-NC-SA 4.0 for educational and non-commercial research use.