CVE-2025-65199

A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Windscribe v2.18.3-alpha and v2.18.8.

• CWE-78

• https://github.com/Windscribe/Desktop-AppProduct
• https://github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3?diff=unified&w#diff-57e27ab201a1a612609087b839e03bf87a5a063ffcc3f465a6245469bc102754Patch
• https://github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3?diff=unified&w#diff-cfc5df17057ed92112ae70a42c81c57c79f434429210ff881fb0771cf8e39b4cPatch
• https://hackingbydoing.wixsite.com/hackingbydoing/post/windscribe-vpn-local-privilege-escalationExploit, Press/Media Coverage, Third Party Advisory
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-343-01.jsonThird Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2025-65199Third Party Advisory, US Government Resource

Published

Dec 10, 2025

Last Modified

Sep 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65176An issue was discovered in Dynatrace OneAgent before 1.325.4…7.5
• CVE-2025-6518A vulnerability was found in PySpur-Dev pyspur up to 0.1.18.…6.3
• CVE-2025-65185There is a username enumeration via local user login in Entr…2.8
• CVE-2025-65186Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS).…6.1
• CVE-2025-65187A Stored Cross Site Scripting vulnerability exists in CiviCR…6.1
• CVE-2025-6519E3 Site Supervisor (firmware version < 2.31F01) has a defaul…9.8
• CVE-2025-6520Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2025-65202TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS co…8
• CVE-2025-65203KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill …7.1
• CVE-2025-6521During the initial setup of the device the user connects to …7.6
• CVE-2025-65212An issue was discovered in NJHYST HY511 POE core before 2.1 …9.8
• CVE-2025-65213MooreThreads torch_musa through all versions contains an uns…9.8