CVE-2025-32701: Windows CLFS Driver use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable kernel privilege-escalation flaw with confirmed in-the-wild exploitation per CISA KEV, though it requires an existing low-privileged foothold rather than remote access.

What it is

The Windows Common Log File System (CLFS) driver contains a use-after-free (CWE-416) that lets an authorized local attacker elevate privileges. It affects a broad set of Windows 10, Windows 11 and Windows Server releases. Because CLFS is a core kernel component, a successful exploit yields SYSTEM-level code execution on the host.

Impact

An attacker who already holds a low-privileged local account can gain full control of the machine, including reading or altering sensitive data and installing software. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached locally (AV:L) with low attack complexity and no user interaction; the attacker needs only low privileges (PR:L), meaning any authenticated local user or code running in a user context can trigger it. No network or remote vector is described.

Exploitation

CVE-2025-32701 was added to CISA's Known Exploited Vulnerabilities catalog on 2025-05-13 with a remediation due date of 2025-06-03, indicating exploitation in the wild. EPSS is modest (0.01392, ~71st percentile), and CISA records no known ransomware campaign use.

What to do

• Apply the Microsoft security update for CVE-2025-32701 across all affected Windows 10, Windows 11 and Windows Server versions; prioritize internet-facing and multi-user systems.
• Meet the CISA KEV due date of 2025-06-03; if patching is not possible, follow vendor mitigations or discontinue use of the affected product.
• Restrict and monitor local interactive logon and low-privileged account use on sensitive hosts to reduce the pool of accounts that can trigger the flaw.
• Track the Microsoft advisory for any additional hardening guidance and verify patch state with your vulnerability management tooling.

Detection

• Monitor for unexpected processes gaining SYSTEM integrity from a non-system parent, especially child processes of user-session applications.
• Alert on unusual access or handle activity against the CLFS driver and its log files by non-system processes.
• Correlate local privilege-escalation exploit indicators with endpoint telemetry around the KEV publication window and after.
• Audit for unpatched Windows builds in the affected product list and flag hosts still missing the May 2025 update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.