CVE-2025-21418
Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability
Description
CVE-2025-21418 is a high-severity elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), a core kernel-mode driver used by the Windows networking stack. The flaw allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level privileges on affected Windows systems. With a CVSS v3.1 base score of 7.8 and an EPSS score of 8.43% at the 92nd percentile, this vulnerability is actively exploited in the wild. CISA has added CVE-2025-21418 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 4, 2025, underscoring the urgency of applying the February 2025 Patch Tuesday updates across all affected Windows versions.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.10240.20915 |
| microsoft | windows 10 1809 | < 10.0.17763.6893 |
| microsoft | windows 10 21h2 | < 10.0.19044.5487 |
| microsoft | windows 10 22h2 | < 10.0.19045.5487 |
| microsoft | windows 11 22h2 | < 10.0.22621.4890 |
| microsoft | windows 11 23h2 | < 10.0.22631.4890 |
| microsoft | windows 11 24h2 | < 10.0.26100.3107 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7785 |
| microsoft | windows server 2019 | < 10.0.17763.6893 |
| microsoft | windows server 2022 | < 10.0.20348.3148 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1425 |
| microsoft | windows server 2025 | < 10.0.26100.3107 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21418(US Government Resource)
Weakness Type
Elevation of Privilege in Kernel-Mode Driver
CVE-2025-21418 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys). While no specific CWE has been formally assigned, the vulnerability is consistent with improper input validation or memory safety weaknesses in a kernel-mode driver that allow a low-privileged process to gain SYSTEM-level access. The AFD.sys driver handles WinSock operations at the kernel level, and a flaw in its processing logic enables an attacker to manipulate the driver in a way that elevates their privileges beyond what their user account would normally permit.
Impact Analysis
CVE-2025-21418 poses a critical threat to Windows environments across the enterprise. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability requires local access with low-privilege authentication but no user interaction, and achieves maximum impact across all three security dimensions. Confidentiality (High): An attacker escalating to SYSTEM can access any data on the system, including credentials stored in memory (via tools like Mimikatz), registry secrets, encrypted files, and sensitive application data that would be inaccessible to standard users. Integrity (High): SYSTEM-level access allows modification of any file, registry key, or system configuration. The attacker can install rootkits, disable security software, create backdoor accounts, modify audit logs, and tamper with operating system components. Availability (High): With SYSTEM privileges, an attacker can stop critical services, corrupt system files, disable recovery mechanisms, or render the system completely inoperable. The EPSS score of 8.43% at the 92nd percentile confirms elevated exploitation activity. The vulnerability affects virtually all supported Windows versions from Windows 10 through Windows Server 2025, including legacy Windows Server 2008 and 2012 under extended security updates, making the blast radius extremely large. Ransomware use is currently listed as unknown, but privilege escalation vulnerabilities in Windows are a cornerstone of virtually every ransomware attack chain.
Exploit Maturity
CVE-2025-21418 demonstrates high exploit maturity with confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming that threat actors are actively exploiting this privilege escalation flaw, with a mandatory remediation deadline of March 4, 2025. Microsoft acknowledged active exploitation in its February 2025 security update advisory. The EPSS score of 8.43% at the 92nd percentile indicates a significantly elevated probability of exploitation. Windows kernel-mode driver vulnerabilities in AFD.sys have a history of exploitation — similar AFD.sys elevation of privilege vulnerabilities have been exploited by advanced persistent threat groups and commodity malware alike. The local access requirement does not significantly reduce the threat, as attackers commonly chain privilege escalation vulnerabilities with remote code execution flaws or social engineering for initial access. Ransomware association is currently listed as unknown, but elevation of privilege to SYSTEM is a critical step in virtually every modern ransomware deployment.
Remediation
-
Apply the February 2025 Patch Tuesday security updates immediately. Microsoft released patches for CVE-2025-21418 as part of the February 11, 2025 security update cycle. Install the applicable cumulative update for each affected Windows version. Consult the Microsoft Security Response Center advisory for specific KB article numbers and update links for each platform.
-
Prioritize patching across all affected Windows versions. The vulnerability affects Windows 10 (all supported versions from 1607 through 22H2), Windows 11 (22H2, 23H2, 24H2), Windows Server 2016 through 2025, and legacy Windows Server 2008/2012 under extended security updates. Ensure that all systems, including those in test and staging environments, are included in the patch deployment.
-
Implement defense-in-depth against privilege escalation. Deploy endpoint detection and response (EDR) solutions configured to detect anomalous privilege escalation attempts, particularly from non-administrative user contexts targeting kernel-mode drivers. Enable Windows Credential Guard and Device Guard where supported to limit the impact of SYSTEM-level compromise.
-
Monitor for indicators of compromise. Review security event logs for unusual process behavior, unexpected SYSTEM-level processes spawned by low-privilege users, and anomalous WinSock or AFD.sys driver interactions. Deploy detection rules targeting known exploit patterns for Windows kernel privilege escalation.
-
Enforce least privilege access policies. Ensure that standard users do not have unnecessary local administrator rights, as removing local admin privileges reduces the attacker's ability to reach a position where kernel driver exploitation is practical. Implement application control policies to restrict execution of unauthorized code.
Technical Details
CVE-2025-21418 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), a fundamental kernel-mode driver in the Windows networking subsystem. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H specifies that the vulnerability requires local access with low-privilege authentication, no user interaction, and results in complete compromise of confidentiality, integrity, and availability within the scope of the vulnerable system. The AFD.sys driver operates at Ring 0 (kernel mode) and handles the translation between user-mode WinSock API calls and the underlying Transport Driver Interface (TDI) or Winsock Kernel (WSK) transport layer. The vulnerability allows a low-privileged local user to interact with the AFD.sys driver in a way that triggers a condition resulting in privilege escalation to SYSTEM level. The specific technical mechanism has not been fully disclosed by Microsoft, but the vulnerability class is consistent with either a buffer overflow, use-after-free, or improper validation of user-supplied parameters within the kernel driver's IOCTL handling routines. Successful exploitation elevates the attacker's process token to NT AUTHORITY\SYSTEM, granting unrestricted access to all system resources. The affected versions span the entire supported Windows ecosystem: Windows 10 versions 1607 through 22H2, Windows 11 versions 22H2 through 24H2, Windows Server 2008 through 2025, reflecting the long-standing presence of AFD.sys as a core networking component across all Windows releases.
Frequently Asked Questions
Is CVE-2025-21418 being actively exploited?
Yes. Microsoft has confirmed active exploitation in the wild, and CISA has added CVE-2025-21418 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 4, 2025. The EPSS score of 8.43% at the 92nd percentile reflects elevated exploitation activity.
What Windows versions are affected by CVE-2025-21418?
CVE-2025-21418 affects virtually all supported Windows versions: Windows 10 (versions 1607 through 22H2), Windows 11 (22H2, 23H2, 24H2), Windows Server 2016 through 2025, and legacy Windows Server 2008 and 2012 under extended security updates. The vulnerability exists in the AFD.sys kernel driver present across all these platforms.
How do I fix CVE-2025-21418?
Apply the February 2025 Patch Tuesday cumulative updates from Microsoft. Each affected Windows version has a specific KB update that patches the AFD.sys driver. Visit the Microsoft Security Response Center advisory for your specific platform's update details and installation instructions.
Can CVE-2025-21418 be exploited remotely?
No. The vulnerability requires local access to the system with at least low-privilege authentication. However, attackers commonly chain this type of privilege escalation with remote access vectors such as phishing, remote code execution vulnerabilities, or compromised credentials to achieve full SYSTEM-level access on target systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.