CVE-2025-24983
published 2025-03-11CVE-2025-24983: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
PriorityP184high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-04-01
Exploited in the wild
EPSS
1.30%
67.2th percentile
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft | windows_10_1607 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27618 | 6.1.7601.27618 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.23168 | 6.0.6003.23168 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25368 | 6.2.9200.25368 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22470 | 6.3.9600.22470 |
| microsoft | windows_server_2016 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.7876 | 10.0.14393.7876 |
| msrc | windows_10_for_32-bit_systems | — | — |
| msrc | windows_10_for_x64-based_systems | — | — |
| msrc | windows_10_version_1607_for_32-bit_systems | — | — |
| msrc | windows_10_version_1607_for_x64-based_systems | — | — |
| msrc | windows_server_2008_for_32-bit_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_for_x64-based_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_r2_for_x64-based_systems_service_pack_1 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2025-24983 is a use-after-free in the Windows Win32 Kernel Subsystem exploited in the wild; monitor for local privilege escalation to SYSTEM via a race condition in Win32k. ↗
- →Exploitation requires winning a race condition; hunt for repeated rapid Win32k syscall patterns indicative of race-condition exploitation attempts. ↗
- →Successful exploitation grants SYSTEM privileges; alert on unexpected SYSTEM-level process creation from non-SYSTEM parent processes on Windows endpoints. ↗
- →Exploitation has been observed in targeted cyber espionage campaigns; treat detections of CVE-2025-24983 exploitation as high-severity targeted intrusion events. ↗
- →CVE-2025-24983 exploitation status is confirmed in the wild; prioritize patching and monitor exploit detection telemetry on all affected Windows versions. ↗
- ·Windows 11 version 24H2 systems are not affected by the observed exploitation even though the vulnerability is present in the codebase. ↗
- ·Patches for Windows 10 LTSB 2015 were delayed at time of reporting; systems running that version may remain unpatched and should be treated as higher risk. ↗
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.0HIGH
cisa7.0HIGH
vendor_msrc7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f4fr-5w7w-pg2w: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally
ghsa_unreviewed·2025-03-11
CVE-2025-24983 [HIGH] CWE-416 GHSA-f4fr-5w7w-pg2w: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
VulnCheck
Microsoft Windows Win32k Use-After-Free Vulnerability
vulncheck·2025·CVSS 7.0
CVE-2025-24983 [HIGH] CWE-416 Microsoft Windows Win32k Use-After-Free Vulnerability
Microsoft Windows Win32k Use-After-Free Vulnerability
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Mar; https://bsky.app/profile/esetresearch.bsky.social/post/3lk4kxsk57s2o; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabil
CISA
Microsoft Windows Win32k Use-After-Free Vulnerability
cisa·2025-03-11·CVSS 7.0
CVE-2025-24983 [HIGH] CWE-416 Microsoft Windows Win32k Use-After-Free Vulnerability
Vulnerability: Microsoft Windows Win32k Use-After-Free Vulnerability
Affected: Microsoft Windows
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24983 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24983
Remediation Due Date: 2025-04-01
Microsoft
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
vendor_msrc·2025-03-11·CVSS 7.0
CVE-2025-24983 [HIGH] CWE-416 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Description: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Windows Win32 Kernel Subsystem: Windows Win32 Kernel Subsystem
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:Yes;Latest S
No detection rules found.
No public exploits indexed.
Tenable
Patch Tuesday 2025 Year In Review
blogs_tenable·2025-12-10
Patch Tuesday 2025 Year In Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Microsoft: Windows CLFS zero-day exploited by ransomware gang
blogs_bleepingcomputer·2025-04-08·CVSS 7.8
[HIGH] Microsoft: Windows CLFS zero-day exploited by ransomware gang
## Microsoft: Windows CLFS zero-day exploited by ransomware gang
## Sergiu Gatlan
While the company has issued security updates for impacted Windows versions, it delayed releasing patches for systems running Windows 10 LTSB 2015 and said they would be released as soon as possible.
"The targets include organizations in the information technology (IT) and real estate sectors of the United States, the financial sector in Venezuela, a Spanish software company, and the retail sector in Saudi Arabia," Microsoft revealed today .
"Customers running Windows 11, version 24H2 are not affected by the observed exploitation, even if the vulnerability was present. Microsoft urges customers to apply these updates as soon as possible."
Microsoft linked these attacks to the RansomEXX ransomware gang, w
Checkpoint
17th March – Threat Intelligence Report
blogs_checkpoint·2025-03-17
CVE-2025-24983 17th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 17th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 17th March, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Check Point Research elaborates about the pro-Palestinian hacktivist group “Dark Storm” which claimed the large-scale DDoS attack against X (formerly Twitter). The attack disrupted access to the platform, causing outages for users worldwide. Recently, Dark Storm was also targeting Western organizations and critical infrastruc
Bleepingcomputer
Microsoft patches Windows Kernel zero-day exploited since 2023
blogs_bleepingcomputer·2025-03-12·CVSS 7.8
CVE-2025-24983 [HIGH] Microsoft patches Windows Kernel zero-day exploited since 2023
## Microsoft patches Windows Kernel zero-day exploited since 2023
## Sergiu Gatlan
ESET said on Tuesday that a zero-day exploit targeting the CVE-2025-24983 vulnerability was "first seen in the wild" in March 2023 on systems backdoored using PipeMagic malware.
This exploit targets only older Windows versions (Windows Server 2012 R2 and Windows 8.1) that Microsoft no longer supports. However, the vulnerability also affects newer Windows versions, including the still-supported Windows Server 2016 and Windows 10 systems running Windows 10 build 1809 and earlier.
"The Use-After-Free (UAF) vulnerability is related to improper memory usage during software operation. This can lead to software crashes, execution of malicious code (including remotely), privilege escalation, or data corruption,"
Krebs
Microsoft: 6 Zero-Days in March 2025 Patch Tuesday
blogs_krebs·2025-03-12·CVSS 7.0
CVE-2025-24991 [HIGH] Microsoft: 6 Zero-Days in March 2025 Patch Tuesday
Microsoft today issued more than 50 security updates for its various Windows operating systems, including fixes for a whopping six zero-day vulnerabilities that are already seeing active exploitation.
Two of the zero-day flaws include CVE-2025-24991 and CVE-2025-24993, both vulnerabilities in NTFS, the default file system for Windows and Windows Server. Both require the attacker to trick a target into mounting a malicious virtual hard disk. CVE-2025-24993 would lead to the possibility of local code execution, while CVE-2025-24991 could cause NTFS to disclose portions of memory.
Microsoft credits researchers at ESET with reporting the zero-day bug labeled CVE-2025-24983, an elevation of privilege vulnerability in older versions of Windows. ESET said the exploit was deployed via the PipeMa
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review
blogs_qualys·2025-03-11
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for March 2025
Adobe Patches for March 2025
Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Risk Reduction via TruRisk Eliminate
Qualys Monthly Webinar Series
March 2025 Patch Tuesday is here, and Microsoft has rolled out critical security updates that address multiple vulnerabilities across its product suite. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tu
Talos
Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-03-11·CVSS 7.8
CVE-2025-26633 [HIGH] Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for March of 2025 which includes 57 vulnerabilities affecting a range of products, including 6 that Microsoft marked as “critical”.
There are six vulnerabilities that Microsoft has observed being exploited in the wild. CVE-2025-26633 is a Remoted Code Execution (RCE) vulnerability in Microsoft’s Management Console. Two information disclosure vulnerabilities, CVE-2025-24984 and CVE-2025-24991 , and one RCE vulnerability, CVE-2025-24993 , in Windows NTFS were observed being exploited in the wild. Microsoft also patched, CVE-2025-24985 , another RCE exploited in the wild in the Windows Fast FAT system driver. An Elevation of Privilege (EOP) vulnerability,
Tenable
Microsoft’s March 2025 Patch Tuesday Addresses 56 CVEs (CVE-2025-26633, CVE-2025-24983, CVE-2025-24993)
blogs_tenable·2025-03-11·CVSS 7.0
[HIGH] Microsoft’s March 2025 Patch Tuesday Addresses 56 CVEs (CVE-2025-26633, CVE-2025-24983, CVE-2025-24993)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Krebs
Microsoft: 6 Zero-Days in March 2025 Patch Tuesday
blogs_krebs·2025-03-11·CVSS 7.0
CVE-2025-24991 [HIGH] Microsoft: 6 Zero-Days in March 2025 Patch Tuesday
Microsoft today issued more than 50 security updates for its various Windows operating systems, including fixes for a whopping six zero-day vulnerabilities that are already seeing active exploitation.
Two of the zero-day flaws include CVE-2025-24991 and CVE-2025-24993 , both vulnerabilities in NTFS , the default file system for Windows and Windows Server. Both require the attacker to trick a target into mounting a malicious virtual hard disk. CVE-2025-24993 would lead to the possibility of local code execution, while CVE-2025-24991 could cause NTFS to disclose portions of memory.
Microsoft credits researchers at ESET with reporting the zero-day bug labeled CVE-2025-24983 , an elevation of privilege vulnerability in older versions of Windows. ESET said the exploit was deployed via the Pip
Talos
Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
blogs_talos·2025-03-11·CVSS 7.8
CVE-2025-26633 [HIGH] Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for March of 2025 which includes 57 vulnerabilities affecting a range of products, including 6 that Microsoft marked as “critical”.
There are six vulnerabilities that Microsoft has observed being exploited in the wild. CVE-2025-26633 is a Remoted Code Execution (RCE) vulnerability in Microsoft’s Management Console. Two information disclosure vulnerabilities, CVE-2025-24984 and CVE-2025-24991, and one RCE vulnerability, CVE-2025-24993, in Windows NTFS were observed being exploited in the wild. Microsoft also patched, CVE-2025-24985, another RCE exploited in the wild in the Windows Fast FAT system driver. An Elevation of Privilege (EOP) vulnerability, CVE-2025-24983, was also discovered being exploited in the wild, in Windows’ win32 Kernel
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys
blogs_qualys·2025-03-11
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for March 2025
- Adobe Patches for March 2025
- Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Risk Reduction via TruRisk Eliminate
- Qualys Monthly Webinar Series
March 2025 Patch Tuesday is here, and Microsoft has rolled out critical security updates that address multiple vulnerabilities across its product suite. Here’s a quick breakdown of what you need to know.
## Micr
Bleepingcomputer
Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
blogs_bleepingcomputer·2025-03-11·CVSS 7.0
[HIGH] Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
## Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
## Lawrence Abrams
23 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
23 Remote Code Execution Vulnerabilities
4 Information Disclosure Vulnerabilities
1 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
The above numbers do not include Mariner flaws and 10 Microsoft Edge vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5053598 & KB5053602 cumulative updates and the Windows 10 KB5053606 update .
## Six actively exploited zero-days
This month's Patch Tuesday fixes six actively exploited zero-days and one that was publicly exposed, for a total of seven zero-days.
Crowdstrike
March 2025 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] March 2025 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2025-03-11
Published
2025-03-11
Added to CISA KEV
Exploited in the wild