CVE-2025-32701
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Description
CVE-2025-32701 is a high-severity use-after-free vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver that enables local privilege escalation. An authorized attacker with low privileges can exploit this memory corruption flaw to gain SYSTEM-level access on the affected machine. Rated with a CVSS v3.1 base score of 7.8, the vulnerability impacts all modern Windows client and server editions. CISA added CVE-2025-32701 to the Known Exploited Vulnerabilities catalog on May 13, 2025, with a remediation deadline of June 3, 2025, and its EPSS score of 1.54% at the 81st percentile confirms significant exploitation probability aligned with active in-the-wild attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.21014 |
| microsoft | windows 10 1607 | < 10.0.14393.8066 |
| microsoft | windows 10 1809 | < 10.0.17763.7314 |
| microsoft | windows 10 21h2 | < 10.0.19044.5854 |
| microsoft | windows 10 22h2 | < 10.0.19045.5854 |
| microsoft | windows 11 22h2 | < 10.0.22621.5335 |
| microsoft | windows 11 23h2 | < 10.0.22631.5335 |
| microsoft | windows 11 24h2 | < 10.0.26100.3981 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8066 |
| microsoft | windows server 2019 | < 10.0.17763.7314 |
| microsoft | windows server 2022 | < 10.0.20348.3692 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1611 |
| microsoft | windows server 2025 | < 10.0.26100.3981 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32701(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32701(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2025-32701 is classified under CWE-416, Use After Free. This weakness occurs when a program continues to reference memory after it has been freed, which can lead to corruption of valid data, execution of arbitrary code, or a system crash. In the Windows CLFS driver, a kernel-mode memory object is freed but subsequently accessed during log file processing operations, allowing an attacker to manipulate the freed memory region and redirect execution flow to gain SYSTEM privileges.
Learn more: CWE-416 — Use After Free
Impact Analysis
The CVSS v3.1 score of 7.8 (High) for CVE-2025-32701 reflects critical local impact. The attack vector is local (AV:L) with low complexity (AC:L), requiring only low-level privileges (PR:L) and no user interaction (UI:N). Exploitation delivers high impact across all three CIA triad dimensions within the unchanged scope (S:U). Confidentiality is fully compromised as SYSTEM-level access grants unrestricted read access to all files, credentials, and secrets on the machine. Integrity faces maximum impact because the attacker can modify any file, install rootkits, tamper with security configurations, and alter audit trails. Availability is at high risk since the attacker can disable services, corrupt system files, or render the system inoperable. The broad range of affected products, spanning Windows 10, Windows 11, and Windows Server 2008 through 2025, makes this vulnerability a critical escalation primitive for attackers who have achieved initial low-privilege access through phishing, malware, or other footholds.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-32701 by adding it to the Known Exploited Vulnerabilities catalog on May 13, 2025, with a remediation deadline of June 3, 2025. While no public proof-of-concept code has been explicitly tagged in the NVD references, the confirmed in-the-wild exploitation demonstrates that threat actors have developed working exploits. The EPSS score of 1.54% at the 81st percentile places this vulnerability in the top quintile for exploitation probability. The Windows CLFS driver has been a persistent target for privilege escalation attacks, with multiple use-after-free and other memory corruption vulnerabilities in this component exploited by both cybercriminal groups and advanced persistent threats in recent campaigns.
Remediation
-
Deploy the May 2025 Patch Tuesday security updates immediately. Microsoft has issued fixes for all affected Windows versions. Refer to the Microsoft Security Response Center advisory for specific KB articles and patching guidance.
-
Patch all affected Windows platforms, including Windows 10 versions 1507 through 22H2 (below respective patched build numbers), Windows 11 22H2, 23H2, and 24H2, and Windows Server editions from 2008 through 2025. Pay particular attention to Windows Server 2008 and 2012 systems that may require Extended Security Updates.
-
Restrict local access to critical systems as an interim mitigation. Since exploitation requires local, low-privilege access, limiting which users can log on locally or via Remote Desktop reduces the attack surface significantly.
-
Enable and monitor kernel exploitation detection through EDR and advanced threat protection tools. Look for anomalous process behavior indicating privilege escalation from standard user to SYSTEM context, particularly processes spawned by CLFS-related operations.
-
Implement defense-in-depth measures including Credential Guard to protect cached credentials, Attack Surface Reduction (ASR) rules, and strict application allowlisting to limit the impact of successful privilege escalation.
Technical Details
CVE-2025-32701 is a use-after-free (CWE-416) vulnerability in the Windows Common Log File System (CLFS) driver, a kernel-mode component responsible for transactional log management. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local exploitation with low complexity and privileges, resulting in full CIA compromise. The vulnerability occurs when the CLFS driver frees a kernel memory object during log file operations but retains a dangling pointer that is subsequently dereferenced. An attacker can trigger this condition by crafting specific log file operations that cause the driver to access the freed memory region. By manipulating the contents of the freed memory before it is reused, the attacker can control the execution flow and achieve arbitrary code execution in kernel mode. Running code in kernel context grants SYSTEM privileges, bypassing all user-mode security mechanisms. The vulnerability affects all Windows versions from Windows 10 1507 and Windows Server 2008 through Windows 11 24H2 and Windows Server 2025.
Frequently Asked Questions
Is CVE-2025-32701 being actively exploited?
Yes. CISA confirmed active exploitation by adding CVE-2025-32701 to the Known Exploited Vulnerabilities catalog on May 13, 2025. The CLFS driver has been a recurring target for privilege escalation exploits, and threat actors have developed working exploits for this vulnerability.
What products are affected by CVE-2025-32701?
CVE-2025-32701 affects all major Microsoft Windows platforms, including Windows 10 (versions 1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server editions 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025.
How do I fix CVE-2025-32701?
Install the May 2025 cumulative security updates from Microsoft for all affected Windows systems. The Microsoft Security Response Center advisory provides version-specific patch information. As interim measures, restrict local logon access and enable kernel exploit detection in your EDR solution.
How severe is CVE-2025-32701?
CVE-2025-32701 carries a CVSS v3.1 score of 7.8 (High) with full impact on confidentiality, integrity, and availability. The EPSS score at the 81st percentile combined with confirmed active exploitation makes this a high-priority patching target for all Windows environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.