CVE-2025-24983KEV · OVERDUECWE-416

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

High · published March 11, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.0. It is confirmed in active exploitation. It sits in the 71.8th percentile for exploit probability.

571
days past CISA
deadline
CVSS v3.1
7.0
EPSS
1%
Percentile
71.8
In the wild
Confirmed
What it is

⚡ A sneaky use-after-free vulnerability in the Windows Win32 Kernel Subsystem lets an authorized attacker elevate their privileges with surprising ease! 😱 Think of it like a hotel guest who finds a way to access the staff-only areas after checking out—once the door's open, they can wander anywhere they please! 🏨 This flaw allows an attacker to gain elevated privileges on the system, potentially leading to full control over the machine. Imagine someone having the ability to change the locks, rearranging the furniture, or even throwing a wild party without the owner's permission. Absolutely devastating!

Put simply

Think of it like a hotel guest who finds a way to access the staff-only areas after checking out—once the door's open, they can wander anywhere they please! 🏨 The vulnerability arises from improper handling of memory in the Windows Win32 Kernel Subsystem, allowing an attacker with existing authorized access to exploit this flaw and execute code with higher privileges than intended.

What to do

This flaw allows an attacker to gain elevated privileges on the system, potentially leading to full control over the machine. Imagine someone having the ability to change the locks, rearranging the furniture, or even throwing a wild party without the owner's permission. Absolutely devastating! To mitigate this threat, immediately apply patch KBXXXXXX (the exact patch number to be confirmed), and review user permissions to ensure least privilege principles are enforced. Don't leave the front door wide open! You've got this! With the right steps, you'll secure your system in no time and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01375 · 71.8th percentile
Weakness
CWE-416 · Use After Free
Published
2025-03-11T16:59Z
KEV added
2025-03-11 · due 2025-04-01
EPSS history
Timeline
  • 11 MAR 16:59Z
    Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
    cvelistv5
  • 11 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 1
    kev