Vulnerability · Published Dec 10, 2025 · Assigned by cisa-cg
CVE-2025-65199Windscribe for Linux 'changeMTU' local privilege escalation
High 7.8
In plain English
A high-severity OS command injection in Windscribe for Linux Desktop App from Windscribe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.3%top 30.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Windscribe v2.18.3-alpha and v2.18.8.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Windscribe | Windscribe for Linux Desktop App | 2.10.1 – before 2.18.3-alpha2.10.1 – before 2.18.8 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H