CVE-2025-62470CWE-122

CVE-2025-62470

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can exploit a heap-based buffer overflow in Windows' Common Log File System Driver to elevate their privileges locally — a sneaky backdoor for those in the know! 🔥 Think of it like a VIP access pass that lets someone into a secured area of a concert venue, allowing them to roam freely and take control behind the scenes. This vulnerability opens a similar door for attackers, granting them elevated privileges they shouldn’t have in the system. If exploited, this vulnerability could allow attackers to gain full control over the system, enabling them to install malware, access sensitive data, or manipulate system settings. The potential for chaos is absolutely devastating, with an attacker effectively holding the keys to your digital kingdom!

Put simply

Think of it like a VIP access pass that lets someone into a secured area of a concert venue, allowing them to roam freely and take control behind the scenes. This vulnerability opens a similar door for attackers, granting them elevated privileges they shouldn’t have in the system. This vulnerability arises from a heap-based buffer overflow in the Common Log File System Driver, allowing attackers to execute arbitrary code with elevated privileges when they gain access to the system.

What to do

If exploited, this vulnerability could allow attackers to gain full control over the system, enabling them to install malware, access sensitive data, or manipulate system settings. The potential for chaos is absolutely devastating, with an attacker effectively holding the keys to your digital kingdom! To protect your system, ensure you install the latest security updates from Microsoft as soon as they are available. Implement strict access controls to limit unauthorized users and monitor for any suspicious activities that may indicate exploitation attempts. You can tackle this! Stay proactive, patch those systems, and you’ll have this vulnerability on lockdown in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-12-09T23:15Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.868810.0.14393.8688
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Common Log File System Driver Elevation of Privilege Vulnerability
    cvelistv5