Executive brief
A use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver allows a locally authenticated attacker to elevate their privileges. The vulnerability has been observed being exploited in the wild.
Affected products
- Microsoft Windows 10 1507, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2025
Timeline
- 2025-04-08: disclosed
- 2025-04-08: advisory
- 2025-04-08: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2025-04-08: exploited: Reported as exploited in the wild at time of publication.