CVE-2025-29824

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 10 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

0.95%

probability

This CVE has a 0.95% probability of being exploited in the next 30 days.

0% Top 76.6th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-416 · Use After Free CWE-664 · Improper Control of a Resource Through its Lifetime CWE-666 · Operation on Resource in Wrong Phase of Lifetime CWE-672 · Operation on a Resource after Expiration or Release CWE-825 · Expired Pointer Dereference

Google Project Zero

Patched

April 8, 2025

Reported by

Microsoft Threat Intelligence Center

Root Cause Analysis

???

Exploits & PoC

encrypter15/CVE-2025-29824

PoC CVE-2025-29824 — encrypter15/CVE-2025-29824

AfanPan/CVE-2025-29824-Exploit

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

2 repos — triés par ⭐ Rechercher sur GitHub ↗

Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server

TheHackerNews

Microsoft and Adobe Patch Tuesday, April 2025 Security Update Review

Qualys Apr 08, 2025

Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability

TheHackerNews

Microsoft: Windows CLFS zero-day exploited by ransomware gang

BleepingComputer Apr 08, 2025

Security Advisory 2025-017

CERT-EU Apr 11, 2025

⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI-Powered Scams

TheHackerNews

Play ransomware exploited Windows logging flaw in zero-day attacks

BleepingComputer May 07, 2025

BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan

TheHackerNews

PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware

TheHackerNews

Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware

TheHackerNews

Signal Intelligence

Confidenceⓘ

92%

EPSS 0.95%

Mentions 10

Last Seen May 07, 2025

CNA Information

Analyst Note

This CVE is confirmed as exploited in active ransomware campaigns by Play and other threat actors, with coverage from reputable sources including BleepingComputer and CERT-EU advisory confirmation. The presence in Google Project Zero and documented real-world exploitation of the Windows CLFS use-after-free vulnerability substantiate the confirmed status despite not yet appearing in CISA's KEV catalog.