CVE-2025-29824

KEVRansomware UseMicrosoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

Description

Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedApr 8, 2025

Last modifiedJun 17, 2026

Added to KEVApr 8, 2025

Remediation dueApr 29, 2025

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824Vendor Advisory
vicarius.io/vsociety/posts/cve-2025-29824-windows-common-log-file-system-driver-elevation-of-privilege-vulnerability-detection-scriptExploitThird Party Advisory
vicarius.io/vsociety/posts/cve-2025-29824-windows-common-log-file-system-driver-elevation-of-privilege-vulnerability-mitigation-scriptExploitThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29824US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 547 days
Ransomware: Used in known ransomware campaigns
CVSS: 7.8 HIGH
EPSS (30-day exploit probability): 19.3% · top 3% of all CVEs
Weakness: CWE-416

Recommended actions

1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.