---
id: "CVE-2025-24983"
kind: "vulnerability"
aliases: ["CVE-2025-24983"]
title: "Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally"
severity: "high"
cvss: 7.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1507", "fixed": ["10.0.10240.20947"], "affected": "< 10.0.10240.20947", "ecosystem": "vendor"}, {"name": "microsoft windows 10 1607", "fixed": ["10.0.14393.7876"], "affected": "< 10.0.14393.7876", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2008", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows server 2012", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft windows server 2012", "fixed": [], "affected": "= r2", "ecosystem": "vendor"}, {"name": "microsoft windows server 2016", "fixed": ["10.0.14393.7876"], "affected": "< 10.0.14393.7876", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "self-hosted", "windows"]
not_affected_if: ["non-windows"]
published_at: "2025-03-11T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24983", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally

A use-after-free bug in the Windows Win32k kernel subsystem lets an authorized local user raise their privileges. Attackers are already exploiting it in the wild, according to CISA's Known Exploited Vulnerabilities catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?
- vendor:microsoft windows 10 1507 affected < 10.0.10240.20947 fixed 10.0.10240.20947
- vendor:microsoft windows 10 1607 affected < 10.0.14393.7876 fixed 10.0.14393.7876
- vendor:microsoft windows server 2008 affected ? fixed ?
- vendor:microsoft windows server 2008 affected = r2 fixed ?
- vendor:microsoft windows server 2012 affected ? fixed ?
- vendor:microsoft windows server 2012 affected = r2 fixed ?
- vendor:microsoft windows server 2016 affected < 10.0.14393.7876 fixed 10.0.14393.7876

## Fix

Apply the Microsoft security update for CVE-2025-24983 from Windows Update; the sources do not name the patched build.
If no patch is available, follow the vendor mitigations CISA references.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24983
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-24983

## From the sources

Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_