OnlyPatch
Windows Common Log File System Driver

CVE-2025-29824 — Windows Common Log File System Driver Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.13789 ⚠️ Exploited in the wild 🔬 Patch diffed 2025-04 archive

Executive Summary

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Exploited
MS Exploit Status
Exploitation Detected
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Apr 8 2025
Last Updated Apr 8 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.13789 — 0.96179 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Functional
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.2

EPSS Score

0.13789
probability of exploitation in the next 30 days
0.96179 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

31 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5055547 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5055547 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5055521 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5055521 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5055519 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5055519 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5055518 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5055528 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5055523 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5055523 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5055609 (Monthly Rollup) 5055596 (Security Only) Important Elevation of Privilege 5053888 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.0.6003.23220 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5055561 (Monthly Rollup) 5055570 (Security Only) Important Elevation of Privilege 5053620 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.1.7601.27670 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5055561 (Monthly Rollup) 5055570 (Security Only) Important Elevation of Privilege 5053620 Base: 7.8 Temporal: 7.2 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 6.1.7601.27670 Yes None Windows Server 2012 5055581 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5055581 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5055557 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5055557 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5055521 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5055521 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5055519 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5055519 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5055526 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5055526 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5055527 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5055523 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5055523 (Security Update) Important Elevation of Privilege Yes

Patches

10 patches
Article Type Restart
5055547 Security Update Yes
5055521 Security Update Yes
5055519 Security Update Yes
5055518 Security Update Yes
5055528 Security Update Yes
5055523 Security Update Yes
5055581 Monthly Rollup Yes
5055557 Monthly Rollup Yes
5055526 Security Update Yes
5055527 Security Update Yes

Patch Diff

ghidriff · clfs.sys (KB5055523)

Use-after-free on the CLFS log client-context block (CClfsLogCcb). Pre-patch CClfsLogCcb::Cleanup set StateFlags |= 4 at +0x1c and then called CClfsLogCcb::Release() itself, dropping the reference that keeps the CCB alive while CClfsRequest::Close and its unwind path were still using the object. The patch moves the Release into `CClfsRequest::Close'::__l1::fin$0 - which gains CClfsLogCcb::Release in its called-list - so the reference is dropped exactly once at the correct point in the unwind. Gated behind Feature_2931883321; the original release-inside-Cleanup path still ships and runs when the flag is off. Exploited in the wild as a zero-day; reported by Microsoft Threat Intelligence Center. Reachable by any standard user via CreateLogFile + CloseHandle.

Pre-patch version 10.0.26100.3624
Post-patch version 10.0.26100.3775
Function Address Change Note
CClfsLogCcb::Cleanup 1c006e50c -> 1c0074d44 code (Release removed from the flag-enabled path) ratio 0.81, length 309 -> 301. Pre-patch tail: Unlink(this); StateFlags(+0x1c) |= 4; Release(this). Post-patch gains Feature_2931883321 and splits: flag ENABLED sets the flag only; flag DISABLED keeps the original flag+Release. Also reorders the reservation release at +0x68 so local_res8 is zeroed before the negated value is formed.
`CClfsRequest::Close'::__l1::fin$0 1c00783cb -> 1c007840b code (gains CClfsLogCcb::Release) ratio 0.70, length 93 -> 136. The called-list gains CClfsLogCcb::Release and Feature_2931883321. This is where the reference is now dropped - in the Close unwind rather than inside Cleanup.
CClfsRequest::Close code Caller; adjusted so the CCB reference lifetime spans the whole close, with the release deferred to fin$0.
Feature_2931883321__private_IsEnabledDeviceUsageNoInline / _IsEnabledFallback added -- CFR gate Selects between the fixed (deferred release) and original (release-in-Cleanup) behaviour. Both ship in 10.0.26100.3775.
View full diff report View RCA report

Attack Path

Premature reference release in CClfsLogCcb::Cleanup - the CCB is dropped before the Close path has finished with it

Attack path for CVE-2025-29824 Premature reference release in CClfsLogCcb::Cleanup - the CCB is dropped before the Close path has finished with it Attacker CClfsRequest::Close CClfsLogCcb (+0x1c flags) Standard user opens a CLFS log and closes the handle 1 CreateLogFile then CloseHandle. CLFS is a core kernel component on every install; logs live in user-writable directories. Exploited in the wild as a zero-day. CClfsRequest::Close drives CClfsRequest::Cleanup -> CClfsLogCcb::Cleanup 2 Cleanup tears down the read context at +0x100, resets the filesystem flag, hands back the sector count at +0x28 and the reservation at +0x68, then takes the FCB resource exclusive and unlinks the CCB. Cleanup sets StateFlags |= 4 at +0x1c and then calls CClfsLogCcb::Release() itself 3 The reference that keeps the CCB alive is dropped inside Cleanup, while CClfsRequest::Close and its unwind path still hold and use the object. Close continues, and its finally block runs 4 `CClfsRequest::Close'::__l1::fin$0 completes the IRP and unlocks the FCB - but pre-patch it does NOT hold or drop a CCB reference of its own. The Close path operates on a CCB whose last reference Cleanup already released 5 Kernel use-after-free on the log client-context block. Patch moves the Release out of Cleanup and into fin$0: under Feature_2931883321 the Cleanup path sets the flag only, and the finally block performs the Release exactly once at the correct point in the unwind.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Microsoft Threat Intelligence Center

On This Page