CVE-2025-32701
Published: 13 May 2025
Summary
CVE-2025-32701 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 16.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-32701 is a use-after-free vulnerability (CWE-416) in the Windows Common Log File System Driver. It carries a CVSS 3.1 base score of 7.8 and affects the driver component responsible for logging operations in supported Windows versions.
An authorized local attacker with low privileges can trigger the flaw to escalate privileges on the target system, resulting in high impact to confidentiality, integrity, and availability without requiring user interaction.
Microsoft has issued an advisory with remediation details at the MSRC update guide, while CISA lists the CVE in its Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
EPSS values have remained low, moving only from a peak of 0.0208 to a current score of 0.0186.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14443
Vulnerability details
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- CWE(s)
- KEV Date Added
- 13 May 2025
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor security updates that remediate the use-after-free flaw in the CLFS driver before exploitation can succeed.
Enforces least privilege so that a low-privileged local account cannot reach the SYSTEM-level access obtained after triggering the driver flaw.
Requires memory-protection mechanisms that can block or complicate exploitation of use-after-free conditions in kernel drivers.