TLDR Tech / InfoSec
Discovery & Analysis of CVE-2025-29969
CVE-2025-29969 is a remote code execution vulnerability in the MS-EVEN RPC protocol — enabled by default on Windows 11 and Windows Server 2025 — that allows low-privileged users to write arbitrary files remotely by exploiting a TOCTOU flaw in the EventLog backup function, effectively bypassing default C$ share limitations. The attack chain combines a hidden CreateFile primitive for remote file/directory existence checks with an arbitrary write primitive achieved by swapping an attacker-controlled EVTX file on a remote SMB share between header validation and backup, enabling code execution via Startup folder batch scripts or DLL hijacking. Microsoft patched the TOCTOU write primitive in May 2025, though the recon capabilities enabling remote file enumeration across domain-joined machines remain unpatched.
Read the full story