CVE-2025-24983MicrosoftOperating systemsMarch 11, 2025

Microsoft Windows Win32k Use-After-Free Vulnerability

High 7Actively exploited

Description

Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Running Microsoft devices? Get an email when a new vulnerability comes out. Free, unsubscribe in one click.
Turn on Microsoft alerts

Details

Vendor
Microsoft
Product
Windows
CVE
CVE-2025-24983
Affected versions
Windows 10 Version 1507 10.0: from 10.0.10240.0 to 10.0.10240.20947 (excluded) — fixed in 10.0.10240.20947
Windows 10 Version 1607 10.0: from 10.0.14393.0 to 10.0.14393.7876 (excluded) — fixed in 10.0.14393.7876
Windows Server 2008 R2 Service Pack 1 6.1: from 6.1.7601.0 to 6.1.7601.27618 (excluded) — fixed in 6.1.7601.27618
Windows Server 2008 R2 Service Pack 1 (Server Core installat 6.1: from 6.1.7601.0 to 6.1.7601.27618 (excluded) — fixed in 6.1.7601.27618
Windows Server 2008 Service Pack 2 6.0: from 6.0.6003.0 to 6.0.6003.23168 (excluded) — fixed in 6.0.6003.23168
Windows Server 2008 Service Pack 2 (Server Core installation 6.0: from 6.0.6003.0 to 6.0.6003.23168 (excluded) — fixed in 6.0.6003.23168
Windows Server 2012 6.2: from 6.2.9200.0 to 6.2.9200.25368 (excluded) — fixed in 6.2.9200.25368
Windows Server 2012 (Server Core installation) 6.2: from 6.2.9200.0 to 6.2.9200.25368 (excluded) — fixed in 6.2.9200.25368
Windows Server 2012 R2 6.3: from 6.3.9600.0 to 6.3.9600.22470 (excluded) — fixed in 6.3.9600.22470
Windows Server 2012 R2 (Server Core installation) 6.3: from 6.3.9600.0 to 6.3.9600.22470 (excluded) — fixed in 6.3.9600.22470
Windows Server 2016 10.0: from 10.0.14393.0 to 10.0.14393.7876 (excluded) — fixed in 10.0.14393.7876
Windows Server 2016 (Server Core installation) 10.0: from 10.0.14393.0 to 10.0.14393.7876 (excluded) — fixed in 10.0.14393.7876 (from the advisory and NVD; check the exact builds in the official advisory)
CVSS score
7
Actively exploited
Yes, listed in the CISA Known Exploited Vulnerabilities catalog
CISA due date
April 1, 2025 (deadline for US federal agencies: a good benchmark for you too)
Source
CISA KEV – original advisory
Published
March 11, 2025

The description and the recommended action are quoted from the public advisory; severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.

More Microsoft advisories