CVE-2025-21271
Published: 14 January 2025
Summary
CVE-2025-21271 is a high-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 48.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely flaw remediation through vendor patches, directly preventing exploitation of the known elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver.
Enforces least privilege for processes and users, limiting the scope and impact of local low-privilege attackers exploiting CVE-2025-21271 for elevation.
Provides memory protections such as non-executable memory and isolation to mitigate buffer over-read (CWE-126) exploits in the driver that enable privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes a local EoP vulnerability in a Windows driver that is directly exploitable by low-privileged attackers to elevate to higher privileges (including SYSTEM).
NVD Description
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21271 is an Elevation of Privilege vulnerability in the Windows Cloud Files Mini Filter Driver. This flaw, published on 2025-01-14, carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-126 and NVD-CWE-noinfo. It affects Windows systems utilizing the Cloud Files Mini Filter Driver component.
A local attacker with low privileges can exploit this vulnerability due to its local attack vector and low complexity requirements, with no user interaction needed. Successful exploitation grants high impacts on confidentiality, integrity, and availability, enabling the attacker to elevate privileges, potentially achieving full system compromise.
Microsoft's Security Response Center provides an update guide detailing mitigation and patching information for CVE-2025-21271 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21271.
Details
- CWE(s)