CVE-2025-21315
Published: 14 January 2025
Summary
CVE-2025-21315 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 37.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the elevation of privilege vulnerability by requiring timely remediation through vendor patches for the Microsoft Brokering File System flaw.
Implements memory protections such as ASLR and DEP that directly counter exploitation of the underlying CWE-416 use-after-free error in the file system broker.
Enforces least privilege on low-privilege local accounts, limiting the access and potential attack surface for triggering the high-complexity EoP vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local elevation of privilege vulnerability (CWE-416 use-after-free) in a Microsoft kernel/file system component that can be directly exploited by a low-privileged attacker to gain higher privileges, matching the definition of T1068 Exploitation for Privilege Escalation.
NVD Description
Microsoft Brokering File System Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21315 is an Elevation of Privilege vulnerability affecting the Microsoft Brokering File System. Published on 2025-01-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and is linked to CWE-416, with additional NVD-CWE-noinfo classification.
A local attacker with low privileges can exploit this vulnerability, which requires high attack complexity but no user interaction. Successful exploitation changes scope and enables high-impact effects on confidentiality, integrity, and availability, allowing privilege escalation on the affected system.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21315 provides details on patches and mitigation guidance.
Details
- CWE(s)