Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation

CVE-2024-21338 is a local privilege escalation flaw in the Microsoft Windows kernel caused by an exposed IOCTL with insufficient access control (CWE-822): a low-privileged process running locally can issue specially crafted requests to a kernel interface without proper authorization checks. Public research (including Avast's analysis of Lazarus Group's FudModule rootkit) ties the vulnerable component to the Windows AppLocker/AppID driver and shows the bug was exploited as an admin-to-kernel zero-day, letting an attacker with a foothold on a machine gain kernel-level privileges and full control of the host. Because it requires only local access, it is typically chained after initial access or malware delivery, and CISA notes known ransomware use alongside exploitation by North Korea's Lazarus Group. Any organization or device running Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2019/2022 (including 2022 23H2) is affected until patched. The bug was added to the CISA Known Exploited Vulnerabilities catalog on 2024-03-04 after in-the-wild exploitation and was fixed in Microsoft's March 2024 Patch Tuesday release; EPSS places the 30-day exploitation probability at roughly 60% (99th percentile).

Do: Apply Microsoft's March 2024 (or later) cumulative security updates to every listed Windows 10, Windows 11, and Windows Server 2019/2022 system, and verify the installed build includes the March 2024 fixes before closing the KEV entry; if patches are unavailable, follow CISA's required action to apply vendor mitigations or discontinue use. Because this is a local-only escalation commonly chained after initial access, prioritize workstations and servers where untrusted users or code run locally. Hunt for Lazarus/FudModule and BYOVD-related indicators per Avast's published research on hosts of interest.

The Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free flaw (CWE-416) that allows a local attacker to escalate privileges. An attacker who can already execute code on a Windows host — typically after gaining initial access via phishing, malware, or chaining with another vulnerability — triggers the bug to gain SYSTEM-level privileges, giving them near-full control of the machine. Any Windows host running an affected build is exposed to the flaw, though it requires local code execution and is not remotely exploitable on its own. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2024-08-13 and Microsoft shipped fixes in its August 2024 security updates, while the ransomware association is currently listed as unknown. EPSS is elevated at 28.5% (98th percentile), indicating a high likelihood of continued exploitation over the next 30 days.

Do: Apply Microsoft's August 2024 Windows cumulative security updates (released 2024-08-13) across all Windows clients and servers, prioritizing multi-user hosts such as RDS/VDI servers and jump boxes where local code execution by low-privileged users is more likely. After patching, verify installed build numbers and hunt for signs of local privilege escalation, per CISA's KEV required action to apply vendor mitigations or discontinue use. Keep the host within your KEV remediation SLA, as listing in the catalog signals active exploitation.

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

CVE-2025-21418 is a heap-based buffer overflow (CWE-122) in the Windows Ancillary Function Driver for WinSock (AFD.sys), a kernel-mode driver that services Winsock auxiliary socket operations. A local attacker with limited user privileges can trigger the overflow by issuing crafted Winsock requests to the AFD driver, requiring no user interaction. Successful exploitation elevates the attacker's privileges on the local machine (confidentiality, integrity, and availability all impacted), which is typically used to gain SYSTEM-level control as part of a broader intrusion or ransomware chain. Any system running the affected Windows 10, Windows 11, or Windows Server releases is exposed, since the AFD driver is a core component present on all of them. The flaw was a zero-day exploited in the wild before Microsoft patched it in the February 2025 Patch Tuesday release, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-11.

Do: Deploy Microsoft's February 2025 Patch Tuesday security updates for the affected Windows 10/11 and Windows Server releases immediately, prioritizing multi-user servers, jump hosts, and endpoints in ransomware-prone environments since exploitation was already active before patching. Verify deployment through your patch management/SCCM update history; there is no public PoC or known standalone mitigation, so patching is the required action per the CISA KEV entry.