CVE-2025-29824

Published Apr 8, 2025

Last updated 21 days ago

Windows

CLFS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-29824 is a use-after-free vulnerability in the Windows Common Log File System (CLFS) driver. Successful exploitation of this vulnerability allows an attacker to elevate their privileges to SYSTEM, meaning they can gain complete control over the affected system. This vulnerability has been exploited in the wild as a zero-day, meaning attackers were actively using it before a patch was available. It has been associated with ransomware attacks, where attackers use the elevated privileges to deploy ransomware. The vulnerability was addressed in Microsoft's April 2025 Patch Tuesday update.

Description: Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Exploit added on: Apr 8, 2025
Exploit action due: Apr 29, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-416

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 29

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x32:*",
            "vulnerable": true,
            "matchCriteriaId": "205BF51D-7798-4E52-80C4-D5A72A8F1D12",
            "versionEndExcluding": "10.0.14393.7970"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "2326BC98-7CE6-4FCD-8FF3-9E385465BE69",
            "versionEndExcluding": "10.0.14393.7970"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x32:*",
            "vulnerable": true,
            "matchCriteriaId": "7014722D-3D72-4B1D-9859-9A34E09ED1C4",
            "versionEndExcluding": "10.0.17763.7137"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "C23A8F41-3E3B-4783-B584-04893DD60763",
            "versionEndExcluding": "10.0.17763.7137"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "83B3306F-C4EE-45A6-8139-6FAFC46DC696",
            "versionEndExcluding": "10.0.19044.5737"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x32:*",
            "vulnerable": true,
            "matchCriteriaId": "E23DEC4B-7790-4DF2-9B77-20775AD0B34F",
            "versionEndExcluding": "10.0.19044.5737"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "EDE77D74-EFE2-42C5-A080-AE16F604968B",
            "versionEndExcluding": "10.0.19044.5737"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "BCF4434C-9197-405A-BBB3-53EA66ADAC9A",
            "versionEndExcluding": "10.0.19045.5737"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x32:*",
            "vulnerable": true,
            "matchCriteriaId": "4FF191D7-85ED-430A-BA10-4E696CFF51BA",
            "versionEndExcluding": "10.0.19045.5737"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "3630C9CC-2C8C-4089-926D-0981277CA599",
            "versionEndExcluding": "10.0.19045.5737"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "990A3BD9-13CD-4391-806C-691EAEBEED09",
            "versionEndExcluding": "10.0.22621.5191"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "50EA37C1-EE93-43EF-9D68-BD8E70A094E8",
            "versionEndExcluding": "10.0.22621.5191"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "BA6E9856-A8DC-4C20-A8FC-BCF869413A0A",
            "versionEndExcluding": "10.0.22631.5191"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "39A448D0-EB9F-42FE-85A2-A4AA88D4CEBD",
            "versionEndExcluding": "10.0.26100.3775"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "8B1600DE-F4B9-456C-A42F-5E5CDB2D6DEF",
            "versionEndExcluding": "10.0.26100.3775"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp1:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "BE676429-15DD-408B-A4EC-E405E64F9732",
            "versionEndExcluding": "6.0.6003.23220"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*",
            "vulnerable": true,
            "matchCriteriaId": "167A3F9F-42A7-4D04-A8D5-55C2131E43AC",
            "versionEndExcluding": "6.0.6003.23220"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "6D33A5A5-2116-4DF9-B7B5-AB049D7412DA",
            "versionEndExcluding": "6.0.6003.23220"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DC0C898B-76DC-4C7A-9CB2-2A19AAB5F4A4",
            "versionEndExcluding": "6.2.9200.25423"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A3736F59-1016-4A81-B1D2-5F722CCCFF25",
            "versionEndExcluding": "10.0.14393.7970"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7C505C73-E943-45F2-B869-D6CAAFCA8150",
            "versionEndExcluding": "10.0.17763.7137"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4C707424-4A8F-4C49-AA02-0DA3D177A2FE",
            "versionEndExcluding": "10.0.20348.3454"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0DA8E1E4-0C78-4ADC-9490-4A608D8601FD",
            "versionEndExcluding": "10.0.25398.1551"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "AA03AE1F-F78C-4864-A1B6-15846AAD4899",
            "versionEndExcluding": "10.0.26100.3775"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.