CVE-2025-32709
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Description
CVE-2025-32709 is a high-severity use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), a core kernel-mode driver present in virtually all versions of Microsoft Windows. The flaw allows an authenticated local attacker with low-level privileges to elevate their privileges to SYSTEM level by exploiting a dangling pointer condition in the AFD driver. With a CVSS v3.1 base score of 7.8, this privilege escalation vulnerability affects a wide range of Windows client and server operating systems from Windows Server 2008 through Windows Server 2025 and Windows 11 24H2. CISA has added CVE-2025-32709 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 3, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.21014 |
| microsoft | windows 10 1607 | < 10.0.14393.8066 |
| microsoft | windows 10 1809 | < 10.0.17763.7314 |
| microsoft | windows 10 21h2 | < 10.0.19044.5854 |
| microsoft | windows 10 22h2 | < 10.0.19045.5854 |
| microsoft | windows 11 22h2 | < 10.0.22621.5335 |
| microsoft | windows 11 23h2 | < 10.0.22631.5335 |
| microsoft | windows 11 24h2 | < 10.0.26100.3981 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8066 |
| microsoft | windows server 2019 | < 10.0.17763.7314 |
| microsoft | windows server 2022 | < 10.0.20348.3692 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1611 |
| microsoft | windows server 2025 | < 10.0.26100.3981 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32709(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32709(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2025-32709 is classified under CWE-416, Use After Free. In the Windows Ancillary Function Driver for WinSock, a memory object is freed but a pointer to it is not properly invalidated, creating a dangling reference. When this stale pointer is subsequently dereferenced during driver operations, the program accesses memory that may have been reallocated for other purposes. An attacker can manipulate heap state to place controlled data in the freed memory region, enabling hijacking of program execution flow and privilege escalation from a low-privilege user to SYSTEM.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2025-32709 carries a CVSS v3.1 base score of 7.8 (High) with a local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction needed (UI:N). Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), reflecting that successful exploitation grants SYSTEM-level privileges on the target machine. The AFD.sys driver is a fundamental component of the Windows networking stack present in every Windows installation, making the attack surface extremely broad. The affected versions span from Windows Server 2008 and Windows 10 1507 through the latest Windows Server 2025 and Windows 11 24H2. While the local attack vector means an attacker needs initial access to the system, this vulnerability is highly valuable as a post-exploitation privilege escalation step, commonly chained with remote access vulnerabilities to achieve full system compromise. The EPSS score of 0.84% at the 74th percentile suggests exploitation is targeted rather than widespread.
Exploit Maturity
CVE-2025-32709 shows confirmed exploitation maturity, with CISA adding it to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Microsoft has published a security advisory confirming the vulnerability. The EPSS score of 0.84% at the 74th percentile suggests that while exploitation is confirmed, it is more targeted than widespread, consistent with privilege escalation vulnerabilities that require prior local access. Use-after-free vulnerabilities in Windows kernel drivers are well-understood exploitation targets, and the AFD.sys driver specifically has been the subject of previous privilege escalation exploits, meaning established techniques can be adapted for CVE-2025-32709.
Remediation
- Apply Microsoft security updates immediately. Install the May 2025 cumulative updates for all affected Windows versions. Refer to the Microsoft Security Response Center advisory for specific KB articles per Windows version.
- Prioritize patching based on exposure. Focus first on internet-facing servers and systems accessible to untrusted users, as this privilege escalation vulnerability is most dangerous when combined with remote access.
- Implement endpoint detection and response (EDR). Configure EDR solutions to monitor for suspicious activity involving the AFD.sys driver, including unusual system calls, kernel memory manipulation patterns, and unexpected privilege transitions.
- Apply the principle of least privilege. Review user account privileges across Windows environments. Ensure users do not have unnecessary local administrator rights, as reducing the initial privilege level can limit the utility of local privilege escalation exploits.
- Monitor for post-exploitation indicators. Watch for signs of privilege escalation including unexpected SYSTEM-level process creation from low-privilege user sessions, modifications to sensitive registry keys, and creation of new local administrator accounts.
Technical Details
CVE-2025-32709 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys). The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local attack requiring low privileges, low complexity, no user interaction, with unchanged scope and maximum impact across all CIA dimensions.
The vulnerability exists in how AFD.sys manages memory objects associated with WinSock operations. A race condition or incorrect reference counting causes a memory object to be freed while a pointer to it remains active in the driver's data structures. When the driver subsequently accesses this dangling pointer during normal operation, it reads or writes to memory that has been returned to the kernel memory allocator and may now contain attacker-controlled data. While Microsoft's advisory describes this as a null pointer dereference, the CWE-416 (Use After Free) classification indicates the actual mechanism involves accessing freed memory. An attacker with local access can trigger the vulnerable code path and manipulate the kernel heap to place a crafted object in the freed memory location, redirecting execution to achieve SYSTEM-level privilege escalation.
Frequently Asked Questions
Is CVE-2025-32709 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-32709 to the KEV catalog. The vulnerability requires local access, suggesting exploitation is targeted rather than widespread.
What products are affected by CVE-2025-32709?
Virtually all supported Windows versions are affected, including Windows 10 (1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008 through Windows Server 2025. Specific patched build numbers are listed in the Microsoft advisory.
How do I fix CVE-2025-32709?
Apply the May 2025 Microsoft cumulative security updates for all affected Windows versions. Refer to the Microsoft Security Response Center advisory for specific KB articles corresponding to each Windows version.
How severe is CVE-2025-32709?
CVE-2025-32709 has a CVSS v3.1 base score of 7.8 (High) with maximum impact on confidentiality, integrity, and availability. Successful exploitation grants SYSTEM-level privileges on the target machine, enabling complete control. The EPSS score of 0.84% at the 74th percentile indicates targeted exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.