{"id":"CVE-2025-24983","kind":"vulnerability","aliases":["CVE-2025-24983"],"related":[],"title":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally","description":"Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A use-after-free bug in the Windows Win32k kernel subsystem lets an authorized local user raise their privileges. Attackers are already exploiting it in the wild, according to CISA's Known Exploited Vulnerabilities catalog.","severity":"high","cvss":7.0,"epss":null,"exploited":true,"exploited_at":"2025-03-11T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.20947"],"affected":"< 10.0.10240.20947","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.7876"],"affected":"< 10.0.14393.7876","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.7876"],"affected":"< 10.0.14393.7876","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","windows"],"not_affected_if":["non-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2025-24983 from Windows Update; the sources do not name the patched build.\nIf no patch is available, follow the vendor mitigations CISA references.","status":"open","published_at":"2025-03-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:49:02+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:49:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2025-24983 from Windows Update; the sources do not name the patched build.\nIf no patch is available, follow the vendor mitigations CISA references.","reach":"local","summary":"A use-after-free bug in the Windows Win32k kernel subsystem lets an authorized local user raise their privileges. Attackers are already exploiting it in the wild, according to CISA's Known Exploited Vulnerabilities catalog.","category":"infrastructure","who_cares":["windows","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"A low-privileged local user gains SYSTEM-level control of the machine.","analyst_note":"Find the patched Windows build numbers and the exact mitigation steps in Microsoft's CVE-2025-24983 advisory, linked from the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000439,"input_tokens":2534,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':128C '-2025':18A,21A '-24983':19A,22A '10':27A,31A '1507':28A '1607':32A '2008':36A,40A '2012':44A,48A '2016':52A '22':127C 'accord':87B 'action':118C 'allow':9A,108C 'alreadi':81B 'appli':119C 'applic':125C 'attack':12A,79B,111C 'author':11A,73B,110C 'bod':126C 'bug':64B 'catalog':94B 'cisa':89B,116C 'cloud':131C 'contain':100C 'cve':17A,20A 'discontinu':134C 'elev':14A,113C 'exploit':53B,82B,92B 'follow':124C 'free':3A,63B,105C 'guidanc':129C 'host':57B 'infrastructur':54B 'instruct':123C 'kernel':7A,69B,98C 'known':91B 'let':71B 'local':16A,74B,115C 'microsoft':23A,25A,29A,33A,37A,41A,45A,49A,95C 'mitig':120C,140C 'per':121C 'privileg':15A,78B,114C 'product':138C 'rais':76B 'requir':117C 'self':56B 'self-host':55B 'server':35A,39A,43A,47A,51A 'servic':132C 'subsystem':8A,70B,99C 'unavail':142C 'use':1A,61B,103C,135C 'use-after-fre':60B,102C 'user':75B 'vendor':122C 'vulner':93B,106C 'wild':86B 'win32':6A,97C 'win32k':68B 'window':5A,58B,67B,96C 'windows':24A,26A,30A,34A,38A,42A,46A,50A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-11T00:00:00+00:00","kev":{"dateAdded":"2025-03-11","dueDate":"2025-04-01","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-24983","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983","severity":null,"published_at":"2025-03-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-24983","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24983","severity":null,"published_at":"2025-03-11T17:16:33+00:00","modified_at":"2026-06-17T08:59:55+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}