CVE-2025-29824
Published: 08 April 2025
Summary
CVE-2025-29824 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 25.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-29824 is a use-after-free vulnerability in the Windows Common Log File System Driver. The flaw is tracked under CWE-416 and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low complexity, and no user interaction requirements. Successful exploitation grants an attacker the ability to elevate privileges on an affected Windows system.
An authorized local user can trigger the vulnerability to obtain higher privileges, potentially reaching SYSTEM-level access. Because the issue resides in a kernel-mode driver, the impact extends to the entire operating system rather than being confined to a single user session.
Microsoft’s advisory at msrc.microsoft.com details the affected builds and available updates, while CISA has added the CVE to its Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation. Public detection and mitigation scripts have also been published to help organizations identify unpatched systems and apply workarounds until patches can be deployed. The EPSS score rose from a low baseline to a recorded peak of 0.0137, indicating modest but measurable post-disclosure interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10122
Vulnerability details
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- CWE(s)
- KEV Date Added
- 08 April 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the Microsoft security update that eliminates the use-after-free flaw in the CLFS driver.
Enforces memory-protection mechanisms that block exploitation of use-after-free conditions leading to local privilege escalation.
Limits initial process and user privileges so that a successful CLFS use-after-free yields reduced system impact.