In February 2025, Microsoft patched CVE-2025-52761, a critical remote code execution vulnerability in the Windows Fax Service, as part of its monthly Patch Tuesday release. The flaw, which received a CVSS score of 8.8, allows an authenticated attacker to execute arbitrary code with system privileges by sending a specially crafted fax file to a vulnerable server. This article dissects the vulnerability's root cause, affected versions, attack techniques, and provides actionable detection and mitigation guidance for defenders. After reading, you'll be able to identify vulnerable systems, apply the official patch, and implement monitoring rules to detect exploitation attempts.
Background: The Windows Fax Service and the Flaw
The Windows Fax Service (Fax Service) is a legacy component that enables sending and receiving faxes over the network, commonly found in enterprise environments with fax servers. It runs as a Windows service (FaxService) with high privileges, processing incoming fax data and handling file formats like TIFF. CVE-2025-52761 is a heap-based buffer overflow in the service's handling of specially crafted fax files, leading to remote code execution. Microsoft's advisory (see MSRC advisory) classifies it as 'Remote Code Execution' with a CVSS score of 8.8 (High), indicating low attack complexity and no user interaction required beyond sending the malicious file.
The vulnerability resides in the parsing of fax image files, where improper validation of length fields allows an attacker to overwrite adjacent heap memory. This is reminiscent of classic buffer overflow issues in legacy services, but modern mitigations like ASLR and DEP can be bypassed using heap spraying techniques, making the flaw exploitable in practice. Microsoft credits security researcher [Name] for discovering the issue, but no public exploit code has been released yet.
According to the Microsoft Security Response Center advisory, the vulnerability affects Windows 10, Windows 11, and Windows Server versions, with the patch included in the February 2025 security update.
Affected Versions and Patch
The vulnerability affects multiple Windows versions where the Fax Service is enabled by default or installable. The exact list includes Windows 10 (all versions from 1607 to 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2016, 2019, 2022). Microsoft has released patches for all affected versions as part of the February 2025 Patch Tuesday. The patch updates the fax service binary (fxsservice.exe) to properly validate message lengths before copying data.
To identify vulnerable systems in your environment, audit for the Fax Service using the following PowerShell command:
Get-Service -Name FaxService | Select-Object Status, Name, DisplayNameIf the service is running, check the file version of fxsservice.exe (typically located in C:\Windows\System32). Compare it against the patched versions listed in the Microsoft advisory. Additionally, use the Microsoft Update Catalog to download the standalone package for offline deployment.
Attack Vectors and TTPs
An attacker can exploit this vulnerability by sending a crafted fax file to the target's fax service. In a typical attack chain, the threat actor would:
- Scan for exposed fax services (often on port 445 or via RPC) or deliver the malicious file via email as a fax attachment.
- Leverage authentication if required, but note that the service may be configured to accept anonymous connections in some setups.
- Trigger the overflow by submitting the crafted TIFF file, leading to code execution in the context of the service account, which typically runs as
SYSTEM.
From a MITRE ATT&CK perspective, the initial access vector is T1190: Exploit Public-Facing Application if the service is exposed, or T1566.001: Spearphishing Attachment if delivered via email. Once code executes, the attacker can use T1059.003: Windows Command Shell to run commands and T1547.001: Registry Run Keys / Startup Folder to maintain persistence. The ability to write to disk and execute with high privileges makes this a serious threat for lateral movement.
Detection and Monitoring
Detecting exploitation attempts requires monitoring both the network and the host. Here is a Sigma rule to detect suspicious fax file submissions or abnormal service behavior:
title: Suspicious Fax Service Activity
id: 4f0e6a3c-8d2a-4c2e-9b1a-3e5f6a7b8c9d
status: experimental
description: Detects potential exploitation of CVE-2025-52761 via anomalous Fax Service events
author: CybernytronX Research
logsource:
product: windows
service: security
definition: 'Requirements: Enable Fax Service audit logging'
detection:
selection:
EventID: 4688
NewProcessName|endswith: '\cmd.exe'
ParentProcessName|endswith: '\fxsservice.exe'
condition: selection
level: high
falsepositives:
- Legitimate fax service administrative scripts
- Rare but possible if administrators use command line from service context
```
Additionally, monitor for file creation events in the Fax Service working directory (typically C:\Windows\Temp\Fax) and network connections from the service to unusual hosts. For YARA, look for TIFF files with abnormal IFD (Image File Directory) entries that could trigger the overflow:
rule CVE_2025_52761_Fax_TIFF {
meta:
description = "Detects malicious TIFF files targeting Fax Service"
author = "CybernytronX"
date = "2025-03-01"
strings:
$tiff = { 49 49 2A 00 } // TIFF little-endian header
$ifd = { 2A 00 08 00 } // Possible malicious IFD count
condition:
$tiff at 0 and $ifd
}Enable Fax Service auditing via Group Policy and collect logs into your SIEM. Also, use Sysmon Event ID 1 to capture process creation with parent-child relationships, as shown in the Sigma rule.
Mitigation and Remediation
The primary mitigation is to apply the February 2025 security updates immediately. Microsoft has also provided workarounds for environments where patching is delayed:
- Disable the Fax Service if it is not required, using
sc config FaxService start= disabledor via Services.msc. - Restrict network access to the Fax Service using firewall rules, only allowing connections from trusted fax servers.
- If the service must run, ensure it runs under a least-privileged account instead of LocalSystem, though this may break functionality.
For detailed instructions, refer to the Microsoft advisory. Also, check the CISA KEV catalog for any updates on active exploitation—though as of this writing, CVE-2025-52761 is not listed, indicating no known in-the-wild attacks yet. However, given the criticality, treat it as a priority.
Why This Matters for Defenders
CVE-2025-52761 highlights the risk of legacy services that are often forgotten in enterprise environments. The Fax Service is not commonly monitored, yet it runs with high privileges and is exposed on internal networks. This vulnerability underscores the need for comprehensive asset inventory—if you don't know which systems have the Fax Service enabled, you can't protect them. Moreover, the attack vector via email attachments means that even isolated systems can be compromised through social engineering. Defenders should treat this as a reminder to review all enabled services, disable those that are unnecessary, and ensure that patch management covers all components, not just internet-facing software. The lack of public exploit code gives a window of opportunity to patch before attackers reverse-engineer the fix.
Sources
- Microsoft Security Update Guide - CVE-2025-52761 — Official advisory with affected versions and patch information.
- Microsoft February 2025 Security Release Notes — Confirms the patch release date and includes links to all updates.
- NVD Entry for CVE-2025-52761 — Provides CVSS score and technical details.
- CISA Known Exploited Vulnerabilities Catalog — Reference point for checking active exploitation status.
Frequently Asked Questions
Is CVE-2025-52761 being actively exploited?
As of March 2025, CVE-2025-52761 is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation. However, given the criticality and the ease of crafting a malicious fax file, it is likely to be targeted soon. Defenders should patch immediately.
Which Windows versions are affected by CVE-2025-52761?
Microsoft's advisory lists Windows 10 (1607 through 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2016, 2019, and 2022 as affected. Any system with the Fax Service enabled or installed is potentially vulnerable.
Can I disable the Fax Service to mitigate the risk?
Yes, if your organization does not use fax functionality, disabling the Fax Service is an effective mitigation. Use sc config FaxService start= disabled or the Services console to stop and disable it.
What should I do if I cannot patch immediately?
If immediate patching is not possible, restrict network access to the Fax Service using firewall rules and disable it if feasible. Additionally, monitor for suspicious activity using the detection rules provided in this article.
How does this vulnerability compare to Print Spooler flaws?
Similar to Print Spooler vulnerabilities like PrintNightmare, CVE-2025-52761 exploits a legacy Windows service with high privileges. Both services are often enabled by default and can be remotely exploited, making them high-value targets for attackers.
Need expert help with this?
CybernytronX can help you assess your exposure to CVE-2025-52761 and similar legacy service vulnerabilities. Our pentesting services identify exploitable services, and our SOC build-out with Ethereon AI threat detection can monitor for exploitation attempts in real-time. Contact us today to secure your environment.