CVE-2025-21418
Published: 11 February 2025
Summary
CVE-2025-21418 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 6.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-21418 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock. It carries a CVSS 3.1 base score of 7.8 and is associated with CWE-122, indicating a heap-based buffer overflow that allows an attacker to execute arbitrary code with elevated privileges on an affected Windows system.
A local attacker with low privileges can exploit the flaw without user interaction to obtain full control over the target host, achieving high impact on confidentiality, integrity, and availability. The vulnerability is reachable from standard user contexts, enabling privilege escalation on multi-user or shared Windows systems.
Microsoft’s security advisory at msrc.microsoft.com details the affected Windows versions and provides patches that remediate the issue; organizations should apply the updates promptly. CISA has added CVE-2025-21418 to its Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
EPSS for the CVE reached a peak of 0.1358 before settling at the current value of 0.1029, indicating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2476
Vulnerability details
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 11 February 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local elevation of privilege vulnerability in Windows driver directly enables T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock by requiring timely application of Microsoft patches listed in the MSRC update guide.
Limits the scope and impact of exploitation by low-privileged local attackers through enforcement of least privilege on Windows systems.
Identifies the presence of CVE-2025-21418 via vulnerability scanning, enabling proactive remediation before local exploitation.