CVE-2025-24044
Published: 11 March 2025
Summary
CVE-2025-24044 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in the Windows Win32 Kernel Subsystem through timely flaw remediation and patching.
Implements memory protection mechanisms such as ASLR, DEP, and CFG that mitigate exploitation of use-after-free vulnerabilities in the kernel.
Enforces least privilege for local users and processes, limiting the attack surface and impact of privilege escalation from low-privilege accounts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free vulnerability in Windows kernel subsystem enabling privilege escalation from low-privileged local attacker.
NVD Description
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2025-24044 is a use-after-free vulnerability (CWE-416) in the Windows Win32 Kernel Subsystem. It affects Windows systems and was published on 2025-03-11T17:16:26.093 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authorized local attacker with low privileges can exploit this vulnerability to elevate privileges. The attack vector is local with low attack complexity and no user interaction required, potentially resulting in high impacts to confidentiality, integrity, and availability.
The Microsoft Security Response Center provides an update guide with details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24044.
Details
- CWE(s)