CVE-2025-29824: Windows CLFS Driver Use-After-Free Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable kernel privilege escalation with confirmed KEV listing, known ransomware use, and a high EPSS percentile, though it requires an existing local foothold.

What it is

The Windows Common Log File System (CLFS) driver contains a use-after-free (CWE-416) that lets an authorized local attacker elevate privileges. It affects a broad set of Windows 10, Windows 11, and Windows Server releases. Because CLFS is a core kernel component, successful exploitation yields SYSTEM-level code execution on the host.

Impact

An attacker gains full control of the affected machine, including the ability to read or modify data and install programs. This is a local privilege escalation, so it is typically chained with an initial foothold to move from a low-privileged user to SYSTEM.

Attack surface

Reached locally via the CLFS driver; the CVSS vector is AV:L/AC:L/PR:L/UI:N, meaning the attacker needs low-privileged local access and no user interaction. No network vector or authentication beyond that local account is required.

Exploitation

CISA added it to the KEV catalog on 2025-04-08 with a 2025-04-29 remediation due date and flags known ransomware campaign use. EPSS 30-day probability is 0.13904 (96th percentile), and third-party references are tagged Exploit.

What to do

• Apply the Microsoft security update for CVE-2025-29824 on all affected Windows 10, Windows 11, and Windows Server systems as the first action.
• Prioritize internet-facing and high-value hosts, and meet the CISA KEV due date of 2025-04-29.
• Restrict local interactive and service account privileges to limit the low-privileged access needed to trigger the flaw.
• Monitor for and remove unpatched or end-of-support Windows builds that cannot receive the fix.

Detection

• Hunt for unexpected CLFS driver activity or crashes in the clfs.sys component on endpoints.
• Alert on privilege escalation from a non-administrative process to SYSTEM shortly after suspicious local execution.
• Correlate local logon and process creation events with known post-exploitation behavior on patched and unpatched hosts.
• Track KEV status and EPSS changes for this CVE to prioritize triage of related alerts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.