High severity7.8OSV Advisory· Published Dec 10, 2025· Updated Jun 17, 2026
CVE-2025-65199
CVE-2025-65199
Description
A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Windscribe v2.18.3-alpha and v2.18.8.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6v2.10.10, v2.10.11, v2.10.12, …+ 1 more
- (no CPE)range: v2.10.10, v2.10.11, v2.10.12, …
- (no CPE)range: before v2.18.3-alpha and v2.18.8
cpe:2.3:a:windscribe:windscribe:*:*:*:*:*:linux:*:*+ 3 more
- cpe:2.3:a:windscribe:windscribe:*:*:*:*:*:linux:*:*range: >=2.10.1,<=2.17.10
- cpe:2.3:a:windscribe:windscribe:2.18.1:alpha:*:*:*:linux:*:*
- cpe:2.3:a:windscribe:windscribe:2.18.3:*:*:*:*:linux:*:*
- cpe:2.3:a:windscribe:windscribe:2.18.5:*:*:*:*:linux:*:*
Patches
Vulnerability mechanics
References
5- github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3nvdPatch
- github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3nvdPatch
- hackingbydoing.wixsite.com/hackingbydoing/post/windscribe-vpn-local-privilege-escalationnvdExploitPress/Media CoverageThird Party Advisory
- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-343-01.jsonnvdThird Party Advisory
- www.cve.org/CVERecordnvdThird Party AdvisoryUS Government Resource
News mentions
0No linked articles in our index yet.