CVE-2025-21418
Published: 11 February 2025
Summary
CVE-2025-21418 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 5.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock by requiring timely application of Microsoft patches listed in the MSRC update guide.
Limits the scope and impact of exploitation by low-privileged local attackers through enforcement of least privilege on Windows systems.
Identifies the presence of CVE-2025-21418 via vulnerability scanning, enabling proactive remediation before local exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local elevation of privilege vulnerability in Windows driver directly enables T1068 Exploitation for Privilege Escalation.
NVD Description
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21418 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. Published on 2025-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-122, with additional NVD-CWE-noinfo classification. The flaw affects Windows systems utilizing this driver component.
A local attacker with low privileges can exploit the vulnerability through low-complexity means without requiring user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling privilege escalation on the targeted system.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418 provides details on patching. The vulnerability appears in CISA's Known Exploited Vulnerabilities catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21418, signaling real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 11 February 2025