CVE-2025-24983: Microsoft Windows Win32k Use-After-Free Vulnerability
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Other sources
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
— Microsoft
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.7876Patch KB5053594 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.10240.20947Patch KB5053618 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7601.27618Patch KB5053627 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.22470Patch KB5053887 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.6003.23168Patch KB5053995 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.25368Patch KB5053886
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24983?
CVE-2025-24983 is classified as a use-after-free vulnerability in the Windows Win32 Kernel Subsystem that allows privilege escalation.
How do I fix CVE-2025-24983?
To fix CVE-2025-24983, you need to apply the relevant patches provided by Microsoft for your affected Windows version.
Which versions of Windows are affected by CVE-2025-24983?
CVE-2025-24983 affects multiple versions including Windows 10, Windows Server 2008, and Windows Server 2012 among others.
What type of vulnerability is CVE-2025-24983?
CVE-2025-24983 is a use-after-free vulnerability that can lead to local privilege escalation.
Can an unauthorized attacker exploit CVE-2025-24983?
No, CVE-2025-24983 requires an authorized attacker to exploit the vulnerability for privilege elevation.