CVE-2025-24059
Published: 11 March 2025
Summary
CVE-2025-24059 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 45.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific numeric type conversion flaw in the Windows Common Log File System Driver through timely patching as advised by Microsoft.
Vulnerability scanning identifies the presence of CVE-2025-24059 in the Common Log File System Driver, enabling proactive remediation.
Enforces least privilege on local low-privilege accounts, limiting the scope and impact of privilege escalation attempts via this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local privilege escalation flaw in a Windows kernel driver (Common Log File System), directly enabling T1068 Exploitation for Privilege Escalation via out-of-bounds read and numeric type conversion issues.
NVD Description
Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2025-24059 involves an incorrect conversion between numeric types in the Windows Common Log File System Driver, enabling local privilege escalation. This vulnerability affects the Common Log File System Driver in Windows systems and is classified under CWE-125 (Out-of-bounds Read) and CWE-681 (Incorrect Conversion between Numeric Types). It received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Exploitation allows the authorized attacker to elevate privileges locally, achieving high impacts on confidentiality, integrity, and availability of the affected system.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24059, published on 2025-03-11.
Details
- CWE(s)