CVE-2025-65199: 
Windscribe vulnerability analysis and mitigation

CVE-2025-65199 is a local privilege escalation vulnerability via OS command injection in the Windscribe Linux Desktop App. A local user who is a member of the windscribe group can execute arbitrary commands as root by supplying a malicious value to the adapterName parameter of the changeMTU function. Affected versions span from 2.10.1 through 2.17.10, as well as 2.18.1-alpha, 2.18.3, and 2.18.5 on Linux. The vulnerability was published on December 10, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, ENISA EUVD).

The root cause is improper neutralization of special elements used in an OS command (CWE-78), where the adapterName parameter passed to the changeMTU function is not sanitized before being incorporated into a shell command executed with root privileges. Because the Windscribe helper/service runs as root and accepts IPC calls from members of the windscribe group without adequate input validation, an attacker can inject shell metacharacters or command separators into the adapterName value to break out of the intended command context and execute arbitrary OS commands as root. The attack vector is local, requires low privileges (membership in the windscribe group), and no user interaction. A public proof-of-concept write-up documenting the exploitation technique is available (PoC Write-up, GitHub Patch).

Successful exploitation grants the attacker full root-level access on the affected Linux system, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read or exfiltrate any file on the system, modify system configurations, install persistent backdoors, or disrupt services. Because root access is achieved, lateral movement to other systems sharing credentials or SSH keys stored on the host is also possible (Feedly).

A public proof-of-concept exploit is available on a researcher's blog, demonstrating the privilege escalation technique (PoC Write-up). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.032% (very low probability of near-term exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Confirm the target Linux system has Windscribe Desktop App installed in a vulnerable version (2.10.1–2.17.10, 2.18.1-alpha, 2.18.3, or 2.18.5) and that the attacker's local account is a member of the windscribe group.
2. Identify the IPC mechanism: Locate the Windscribe helper service (running as root) and the IPC interface it exposes to windscribe group members, which includes the changeMTU function.
3. Craft malicious payload: Prepare a value for the adapterName parameter that includes shell command injection characters (e.g., eth0; id; whoami or backtick/$() subshell syntax) to break out of the intended command context.
4. Invoke the vulnerable function: Call the changeMTU function via the IPC interface (e.g., D-Bus or a local socket) with the crafted adapterName payload.
5. Achieve root code execution: The helper service, running as root, passes the unsanitized adapterName to a shell command, executing the injected payload with root privileges — enabling reverse shell establishment, persistence, or further system compromise (PoC Write-up, Feedly).

• Logs: Unexpected root-level command execution entries in /var/log/auth.log or /var/log/syslog originating from the Windscribe helper process; unusual entries in /var/log/windscribe/helper_log.txt referencing changeMTU calls with non-standard adapter names containing shell metacharacters.
• Process: Unusual child processes spawned by the Windscribe helper (e.g., /bin/bash, sh, python3, curl, wget, nc) with root privileges; unexpected processes running as root not associated with normal system activity.
• File System: New cron jobs, systemd services, or SSH authorized keys added under root's home directory (/root/.ssh/authorized_keys); unexpected SUID binaries or scripts placed in world-writable directories.
• Network: Outbound connections from the host to unknown external IPs initiated by root-owned processes, potentially indicating reverse shell or data exfiltration activity.

Windscribe has released fixes in versions 2.18.3-alpha and 2.18.8 for the Linux Desktop App; users should update to v2.18.8 or later as the primary remediation (Feedly, GitHub Patch). As a temporary workaround, administrators should restrict membership in the windscribe group to only trusted users who absolutely require it, applying the principle of least privilege. Additionally, monitoring for unusual root-level process activity originating from the Windscribe helper service is recommended until patching is complete.

A security researcher published a detailed proof-of-concept write-up on the vulnerability, documenting the local privilege escalation technique against the Windscribe Linux Desktop App (PoC Write-up). The vulnerability was assigned by CISA-CG and tracked by ENISA under EUVD-2025-202584. No significant broader media coverage or notable vendor public statements beyond the patch release have been identified.