CVE-2025-29824

ENISA EUVD: EUVD-2025-10122 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 10 articles Published: 2025-04-08

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

0.95%

probability

This CVE has a 0.95% probability of being exploited in the next 30 days.

0% Top 76.6th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

7.8

HIGH

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Temporal

Exploit Code Maturity

Functional

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Description

NVD

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Affected Products

Microsoft

Windows 10 Version 1507

10.0.10240.0

Microsoft

Windows 10 Version 1607

10.0.14393.0

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows 10 Version 21H2

10.0.19044.0

Microsoft

Windows 10 Version 22H2

10.0.19045.0

microsoft

windows 10 1507

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.3775

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22621.5191

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.7970

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.3454

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.7969

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.22523

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.7137

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.5191

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.3453

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

6.0.6003.0 <6.0.6003.23220

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.25423

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.1551

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23220

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.3775

Microsoft

Windows 10 Version 21H2

10.0.19044.0 <10.0.19044.5737

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.7137

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.3775

Microsoft

Windows Server 2008 R2 Service Pack 1

6.1.7601.0 <6.1.7601.27670

Microsoft

Windows 10 Version 21H2

10.0.19043.0 <10.0.19044.5737

Microsoft

Windows 11 version 22H2

10.0.22621.0 <10.0.22621.5189

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.22523

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.5189

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.7136

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.7137

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.5189

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.7970

Microsoft

Windows 10 Version 1507

10.0.10240.0 <10.0.10240.20978

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.7969

Microsoft

Windows 10 Version 1507

N/A

Microsoft

Windows Server 2008 Service Pack 2

6.0.6003.0 <6.0.6003.23220

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

6.1.7601.0 <6.1.7601.27670

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.7970

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.5191

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.7136

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.5737

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.7136

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.25423

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.7969

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-416 · Use After Free CWE-664 · Improper Control of a Resource Through its Lifetime CWE-666 · Operation on Resource in Wrong Phase of Lifetime CWE-672 · Operation on a Resource after Expiration or Release CWE-825 · Expired Pointer Dereference

Google Project Zero

Patched

April 8, 2025

Reported by

Microsoft Threat Intelligence Center

Root Cause Analysis

???

Exploits & PoC

encrypter15/CVE-2025-29824

29 2025-05-14

AfanPan/CVE-2025-29824-Exploit

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

21 2025-07-30

uname1able/CVE-2025-29824

1 2026-03-17

3 repos — triés par ⭐ Rechercher sur GitHub ↗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824

vendor-advisory patch

Signal Intelligence

Confidenceⓘ

92%

EPSS 0.95%

CVSS v3.1 7.8

Mentions 10

Last Seen May 07, 2025

CNA Information

CNA Assigner

microsoft

CNA Title

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Analyst Note

This CVE is confirmed as exploited in active ransomware campaigns by Play and other threat actors, with coverage from reputable sources including BleepingComputer and CERT-EU advisory confirmation. The presence in Google Project Zero and documented real-world exploitation of the Windows CLFS use-after-free vulnerability substantiate the confirmed status despite not yet appearing in CISA's KEV catalog.