CVE-2025-21183
Published: 11 February 2025
Summary
CVE-2025-21183 is a high-severity Double Free (CWE-415) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-21183 is a Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability, published on 2025-02-11. It affects the ReFS deduplication service component in Microsoft Windows operating systems. The vulnerability is associated with CWE-415 and has a CVSS v3.1 base score of 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to significant impacts on confidentiality, integrity, and availability.
A local attacker with no required privileges can exploit this vulnerability. Exploitation demands high attack complexity and requires no user interaction. Successful exploitation enables the attacker to elevate privileges, potentially compromising the system at a high level across confidentiality, integrity, and availability.
Microsoft's update guide provides details on mitigation and patches for CVE-2025-21183 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21183.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2262
Vulnerability details
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local EoP vulnerability in ReFS deduplication service directly enables exploitation for privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the ReFS deduplication service double-free vulnerability (CWE-415) by applying Microsoft patches, preventing local unprivileged attackers from achieving elevation of privilege.
Enforces least functionality by disabling unnecessary ReFS deduplication features, preventing exploitation of the vulnerable service by local attackers.
Limits the impact of successful privilege escalation from the ReFS deduplication service by ensuring system processes and services operate with the minimum privileges necessary.