Elevation of Privilege Vulnerability in Windows Ancillary Function Driver for WinSock
CVE-2025-21418

7.8HIGH

Key Information:

Vendor
Microsoft
Status
Windows 10 Version 1809
Windows Server 2019
Windows Server 2019 (server Core Installation)
Windows Server 2022
Vendor
CVE Published:
11 February 2025

Badges

📈 Score: 1,280💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2025-21418?

CVE-2025-21418 is a critical elevation of privilege vulnerability affecting the Windows Ancillary Function Driver for WinSock, a component integral to network communication in Windows operating systems. This vulnerability enables attackers to gain elevated permissions on compromised systems, potentially allowing unauthorized access to sensitive information and resources. Organizations utilising affected Windows systems may face significant risks, as this flaw could facilitate further exploitation, system compromise, and breaches of confidentiality, integrity, and availability.

Technical Details

The vulnerability exists within the Windows Ancillary Function Driver for WinSock, which is responsible for handling various networking tasks in Windows environments. It is classified as an elevation of privilege vulnerability, meaning that an attacker who has already gained some access to a system can exploit this flaw to elevate their privileges, granting them greater control and the potential to execute arbitrary code at a higher privilege level. Specific technical mechanisms through which the vulnerability can be exploited, including any required configurations or conditions, remain undisclosed.

Potential Impact of CVE-2025-21418

  1. Unauthorized Access: Exploiting this vulnerability may allow an attacker to gain administrative privileges on affected systems, leading to unauthorized access to sensitive data and critical systems.

  2. System Compromise: With elevated privileges, attackers could modify system settings, install malicious software, or manipulate sensitive processes, ultimately compromising the integrity and functionality of the affected systems.

  3. Data Breach Risk: The ability to access and manipulate sensitive information increases the risk of data breaches, potentially exposing confidential business data, user information, or proprietary intellectual property to unauthorized entities.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.20915

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.7785

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.6893

News Articles

favicon imageHelp Net Security

Week in review: Microsoft fixes two actively exploited 0-days, PAN-OS auth bypass hole plugged - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft fixes two actively exploited zero-days

1 week ago

favicon imageHotHardware

February's Patch Tuesday Fixes Dozens Of Windows Security Flaws And Most Are Critical

Microsoft's latest updates fix 63 vulnerabilities of varying severity, so prep your system, save your personal data, and patch that PC.

1 week ago

favicon imageGBHackers News

Windows Driver Zero-Day Vulnerability Let Hackers Remotely Gain System Access

Microsoft has confirmed the discovery of a significant zero-day vulnerability, tracked as CVE-2025-21418, in the Windows Ancillary Function Driver for WinSock.

2 weeks ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by Help Net Security

  • Vulnerability published

  • Vulnerability Reserved

.