CVE-2025-29824highunder attackransomwareCWE-416

CVE-2025-29824: high-severity vulnerability in Microsoft Windows 10 Version 1507

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Published · Updated

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 14%
from disclosure to weapon36 days
Published on NVDApr 8
1st PoC+36d
CISA KEVApr 8
exploitation probability
14%top 4% of all CVEs
observed exploitation
yesCISA + VulnCheck
6 public exploit(s)
Action required by CISAfederal deadline: 2025-04-29

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Windows' logging system allows an authorized user to gain higher privileges on their computer. The vulnerability occurs when the system tries to use memory that was already freed, which an attacker can exploit to run code with administrative rights.

Technical detail

Use-after-free vulnerability in the Windows Common Log File System Driver (CLFS) allows an authenticated local attacker to execute arbitrary code with elevated privileges. The attack requires prior local access and knowledge of the freed memory patterns; successful exploitation results in privilege escalation from user to kernel context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.