CVE-2025-21372
Published: 14 January 2025
Summary
CVE-2025-21372 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 38.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-21372 is an Elevation of Privilege vulnerability affecting the Microsoft Brokering File System. Published on January 14, 2025, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and is linked to CWE-416, with additional NVD-CWE-noinfo classification.
A local attacker with low privileges can exploit this vulnerability. Exploitation requires high attack complexity and local access vector but no user interaction. Successful exploitation enables privilege escalation, yielding high impacts on confidentiality, integrity, and availability within a changed scope.
Microsoft's Security Response Center provides mitigation details and patches via their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21372.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2435
Vulnerability details
Microsoft Brokering File System Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local EoP vulnerability in kernel/driver component directly enables exploitation for privilege escalation from low-privileged local context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-21372 by requiring timely application of Microsoft-provided patches to remediate the use-after-free flaw in the Brokering File System.
Enforces least privilege to limit the initial low-privilege access required for local exploitation and reduces the impact of successful privilege escalation.
Implements memory protection techniques such as ASLR and DEP that increase the high attack complexity of exploiting the use-after-free vulnerability (CWE-416).