Windows 11 Privilege Escalation Vulnerability Let Attackers Gain Admin Access in Under 300 Milliseconds
Security researchers have identified a critical vulnerability in Windows 11, allowing attackers to escalate privileges from a standard user to system-level administrator in 300 milliseconds.
Security researchers have identified a critical vulnerability in Windows 11, allowing attackers to escalate privileges from a standard user to system-level administrator in 300 milliseconds.
The vulnerability, designated as CVE-2025-24076, has been mitigated by Microsoft but remains a critical risk for unpatched systems.
This issue exploited a Dynamic-link Library (DLL) hijacking vulnerability within Windows 11's "Mobile devices" feature, enabling execution of arbitrary code with system privileges.
The vulnerability was discovered during a penetration test using the PrivescCheck tool, which identified suspicious file permissions in a COM server module.
The flaw was due to a DLL file located in a user-modifiable directory (C:\ProgramData\CrossDevice\CrossDevice.Streaming.Source.dll) being loaded by both a regular user process and a high-privileged system process. Although the DLL was signed by Microsoft, the signature was not verified before loading, allowing attackers to replace it with a malicious file.
The vulnerability, designated as CVE-2025-24076, has been mitigated by Microsoft but remains a critical risk for unpatched systems.
Exploitation of this vulnerability was challenging due to the narrow 300-millisecond window between operations. Researchers initially attempted manual replacement of the DLL file, which was unreliable. They developed advanced techniques using Opportunistic Locks to pause program execution until the DLL was released.
The researchers intercepted Windows API calls using Microsoft's Detours library to monitor file closure and time the replacement of the legitimate DLL with a malicious version. A proxy DLL was created to maintain expected functionality while executing unauthorized commands, making the exploit reliable and stealthy.
Microsoft patched CVE-2025-24076 and the related CVE-2025-24994 vulnerability in a security update released on March 11, 2025. The disclosure process began in September 2024, with Microsoft confirming the issues shortly after notification.
Security experts advise immediate application of Windows updates to safeguard systems. Organizations should also implement Endpoint Detection and Response (EDR) solutions to detect unusual behaviors indicating exploitation of similar vulnerabilities.
Despite the sophistication of such exploits, appropriate security measures and timely updates are effective defenses against privilege escalation attempts on Windows systems.
Based on reporting by GBHackers.