Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-38193 | Use-After-Free Privilege Escalation in Microsoft Windows WinSock Driver (afd.sys) The Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free flaw (CWE-416) that allows a local attacker to escalate privileges. An attacker who can already execute code on a Windows host — typically after gaining initial access via phishing, malware, or chaining with another vulnerability — triggers the bug to gain SYSTEM-level privileges, giving them near-full control of the machine. Any Windows host running an affected build is exposed to the flaw, though it requires local code execution and is not remotely exploitable on its own. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2024-08-13 and Microsoft shipped fixes in its August 2024 security updates, while the ransomware association is currently listed as unknown. EPSS is elevated at 28.5% (98th percentile), indicating a high likelihood of continued exploitation over the next 30 days. Do: Apply Microsoft's August 2024 Windows cumulative security updates (released 2024-08-13) across all Windows clients and servers, prioritizing multi-user hosts such as RDS/VDI servers and jump boxes where local code execution by low-privileged users is more likely. After patching, verify installed build numbers and hunt for signs of local privilege escalation, per CISA's KEV required action to apply vendor mitigations or discontinue use. Keep the host within your KEV remediation SLA, as listing in the catalog signals active exploitation. | 7.8 | 29% | KEV PoC |
| mass>1 billion Windows endpoints worldwide, i.e., effectively every unpatched Windows client or server | |
| CVE-2025-21194 | Microsoft Surface Security Feature Bypass Vulnerability Microsoft Surface Security Feature Bypass Vulnerability NVD description · AI analysis pending | 7.1 | <1% |
| — | ||
| CVE-2025-21376 +1 in the same advisory: …21377 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.1 group max | 9% |
| — | ||
| CVE-2025-21418 +1 in the same advisory: …21391 | Local Privilege Escalation via Heap Overflow in Windows WinSock AFD Driver CVE-2025-21418 is a heap-based buffer overflow (CWE-122) in the Windows Ancillary Function Driver for WinSock (AFD.sys), a kernel-mode driver that services Winsock auxiliary socket operations. A local attacker with limited user privileges can trigger the overflow by issuing crafted Winsock requests to the AFD driver, requiring no user interaction. Successful exploitation elevates the attacker's privileges on the local machine (confidentiality, integrity, and availability all impacted), which is typically used to gain SYSTEM-level control as part of a broader intrusion or ransomware chain. Any system running the affected Windows 10, Windows 11, or Windows Server releases is exposed, since the AFD driver is a core component present on all of them. The flaw was a zero-day exploited in the wild before Microsoft patched it in the February 2025 Patch Tuesday release, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-11. Do: Deploy Microsoft's February 2025 Patch Tuesday security updates for the affected Windows 10/11 and Windows Server releases immediately, prioritizing multi-user servers, jump hosts, and endpoints in ransomware-prone environments since exploitation was already active before patching. Verify deployment through your patch management/SCCM update history; there is no public PoC or known standalone mitigation, so patching is the required action per the CISA KEV entry. | 7.8 group max | 2% | KEV |
| masson the order of 1 billion+ Windows devices (all listed Windows 10/11 client and Windows Server releases) |
Full article511 words · extracted from helpnetsecurity.com · click to collapse
February 2025 Patch Tuesday is here, and Microsoft has delivered fixes for 56 vulnerabilities, including two zero-days – CVE-2025-21418 and CVE-2025-21391 – under active exploitation.
CVE-2025-21418 and CVE-2025-21391
CVE-2025-21418 is a vulnerability in the Windows Ancillary Function Driver (AFD.sys), which interfaces with the Windows Sockets API to enable Windows applications to connect to the internet. It can be exploited by attackers to elevate privileges on the target host.
“An authenticated user would need to run a specially-crafted program that ends up executing code with SYSTEM privileges. That’s why these types of bugs are usually paired with a code execution bug to take over a system,” says Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative.
Satnam Narang, Tenable’s senior staff research engineer, says that since 2022, there have been nine elevation of privilege vulnerabilities in the Ancillary Function Driver for WinSock, and only one of those was exploited in the wild as a zero day (CVE-2024-38193).
“According to the reports, CVE-2024-38193 was exploited by the North Korean APT group known as Lazarus Group (also known as Hidden Cobra or Diamond Sleet) to implant a new version of the FudModule rootkit in order to maintain persistence and stealth on compromised systems. At this time, it is unclear if CVE-2025-21418 was also exploited by Lazarus Group,” he added.
CVE-2025-21391 affects Windows Storage in various Windows and Windows Server version. It is another elevation of privilege flaw that, according to Microsoft, would only allow attackers to delete targeted files on a system, and that could lead to the service being rendered unavailable.
Obviously, though, it could also lead to privilege escalation – as described by ZDI researcher Simon Zuckerbraun.
“While we’ve seen similar issues in the past, this does appear to be the first time the technique has been exploited in the wild. It’s also likely paired with a code execution bug to completely take over a system,” Childs commented, and advised users to test and deploy the patch for it quickly.
The two exploited zero-days have been added to CISA’s Known Exploited Vulnerabilities catalog.
Other vulnerabilities of note
CVE-2025-21194, a security feature bypass vulnerability affecting Microsoft Surface laptops, and CVE-2025-21377, a NTLMv2 hash disclosure vulnerability that could be used by attackers to authenticate as the user, have been marked as “publicly disclosed”.
The latter is more likely to be exploited, Microsoft judges. “Organizations using Windows systems that do not exclusively rely on Kerberos for authentication are at risk,” says Mike Walters, President of Action1.
CVE-2025-21376, a critical remote code execution vulnerability stemming from several weaknesses, could be exploited by unauthenticated attackers by sending a specially crafted request to a vulnerable Windows Lightweight Directory Access Protocol (LDAP) server.
“Since there’s no user interaction involved, that makes this bug wormable between affected LDAP servers,” Childs noted. “Microsoft lists this as ‘Exploitation Likely’, so even though this may be unlikely, I would treat this as an impending exploitation.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/02/11/microsoft-fixes-exploited-zero-days-cve-2025-21418-cve-2025-21391-patch-tuesday/