CVE-2025-32709

CVE-2025-32709 is a memory-safety flaw in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver that implements Windows sockets; CISA classifies it as a use-after-free (CWE-416) while Microsoft's description calls it a null pointer dereference. A local, authenticated attacker triggers the flaw through the WinSock driver, with no user interaction or network access required. Successful exploitation elevates the attacker from low privileges to kernel/SYSTEM-level access, giving full control of the host. Any system running the listed Windows 10, Windows 11, or Windows Server versions carries the vulnerable driver, which covers the vast majority of enterprise Windows fleets. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-05-13 as one of the actively exploited zero-days in Microsoft's May 2025 Patch Tuesday release; no public PoC is known and ransomware use is unconfirmed.

What to do: Install the Microsoft security update for CVE-2025-32709 from Microsoft's monthly cumulative updates following the May 13, 2025 disclosure on every affected Windows 10/11 and Windows Server host, prioritizing servers and workstations that allow interactive logon by low-privileged users. Because the flaw is on CISA's KEV catalog, federal agencies must apply the update or vendor-directed mitigations under BOD 22-01. Until patched, restrict local logon rights on Windows servers to trusted accounts and review event logs for suspicious process creations by standard users that indicate privilege-escalation activity.