CVE-2025-24983 | THREATINT

Description

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Reserved 2025-01-30 | Published 2025-03-11 | Updated 2025-03-14 | Assigner microsoft

HIGH: 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CISA Known Exploited Vulnerability

Date added 2025-03-11 | Due date 2025-04-01

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-416: Use After Free

Product status

10.0.10240.0 before 10.0.10240.20947

affected

10.0.14393.0 before 10.0.14393.7876

affected

10.0.14393.0 before 10.0.14393.7876

affected

10.0.14393.0 before 10.0.14393.7876

affected

6.0.6003.0 before 6.0.6003.23168

affected

6.0.6003.0 before 6.0.6003.23168

affected

6.0.6003.0 before 6.0.6003.23168

affected

6.1.7601.0 before 6.1.7601.27618

affected

6.1.7601.0 before 6.1.7601.27618

affected

6.2.9200.0 before 6.2.9200.25368

affected

6.2.9200.0 before 6.2.9200.25368

affected

6.3.9600.0 before 6.3.9600.22470

affected

6.3.9600.0 before 6.3.9600.22470

affected

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983 (Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability) vendor-advisory

cve.org (CVE-2025-24983)

nvd.nist.gov (CVE-2025-24983)

Download JSON