CVE-2025-29824

Microsoft · Published April 8, 2025

7.8

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Windows Common Log File System (CLFS) driver elevation-of-privilege vulnerability. A local attacker can exploit a use-after-free condition to gain SYSTEM-level privileges. Actively exploited by ransomware groups including Storm-0506 and RansomEXX.

Affected Products

Windows 10 (all versions)
Windows 11 (all versions)
Windows Server 2016/2019/2022/2025

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Related Advisories

CVEHIGHCVE-2025-29824

Windows CLFS Zero-Day (CVE-2025-29824) Exploited by RansomEXX to Gain SYSTEM Privileges

Microsoft patched a zero-day in the Windows Common Log File System driver that ransomware operators Storm-0506 and RansomEXX actively exploited to escalate from standard user to SYSTEM before deploying payloads.

WHY IT MATTERS

Every unpatched Windows system is one phishing email away from full domain compromise — patch KB5055523 before the weekend.

MicrosoftWindowsWindows CLFS+3 more

Apr 8, 2025· 4 min read