CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Published May 13, 2025
·
Updated

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.

Other sources

Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

— Microsoft

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

— Microsoft

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

— Microsoft

Affected Software

63 affected componentsFixes available
Microsoft Windows
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2008
Patch availablePatch available
Microsoft Windows Server 2008 R2
Patch available
Microsoft Windows Server 2008 R2
Patch available
Microsoft Windows 10 1507<10.0.10240.21014
Microsoft Windows 10 1607<10.0.14393.8066
Microsoft Windows 10 1809<10.0.17763.7314
Microsoft Windows 10 1809<10.0.17763.7314
Microsoft Windows 10 21h2<10.0.19044.5854
Microsoft Windows 10 22h2<10.0.19045.5854
Microsoft Windows 11 22h2<10.0.22621.5335
Microsoft Windows 11 23h2<10.0.22631.5335
Microsoft Windows 11 24h2<10.0.26100.3981
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=r2-sp1
Microsoft Windows Server 2012
Microsoft Windows Server 2012=r2
Microsoft Windows Server 2016<10.0.14393.8066
Microsoft Windows Server 2019<10.0.17763.7314
Microsoft Windows Server 2022<10.0.20348.3692
Microsoft Windows Server 2022 23h2<10.0.25398.1611
Microsoft Windows Server 2025<10.0.26100.3981
Microsoft Windows Server 2008 R2<6.1.7601.27730
6.1.7601.27730
Microsoft Windows Server 2008<6.0.6003.23317
6.0.6003.23317
Microsoft Windows Server 2008<6.0.6003.23317
6.0.6003.23317
Microsoft Windows Server 2008 R2<6.1.7601.27730
6.1.7601.27730
Microsoft Windows Server 2012 R2<6.3.9600.22577
6.3.9600.22577
Microsoft Windows Server 2008<6.0.6003.23317
6.0.6003.23317
Microsoft Windows Server 2012<6.2.9200.25475
6.2.9200.25475
Microsoft Windows Server 2016<10.0.14393.8066
10.0.14393.8066
Microsoft Windows Server 2012<6.2.9200.25475
6.2.9200.25475
Microsoft Windows Server 2008<6.0.6003.23317
6.0.6003.23317
Microsoft Windows Server 2012 R2<6.3.9600.22577
6.3.9600.22577
Microsoft Windows 10=1607
10.0.14393.8066
Microsoft Windows Server 2016<10.0.14393.8066
10.0.14393.8066
Microsoft Windows 10<10.0.10240.21014
10.0.10240.21014
Microsoft Windows 11=24H2
10.0.26100.406110.0.26100.3981
Microsoft Windows 10<10.0.10240.21014
10.0.10240.21014
Microsoft Windows Server 2022, 23H2 Edition<10.0.25398.1611
10.0.25398.1611
Microsoft Windows 10=1607
10.0.14393.8066
Microsoft Windows Server 2025<10.0.26100.4061, <10.0.26100.3981
10.0.26100.406110.0.26100.3981
Microsoft Windows 11=23H2
10.0.22631.5335
Microsoft Windows 10=22H2
10.0.19045.5854
Microsoft Windows 11=22H2
10.0.22621.5335
Microsoft Windows 11=24H2
10.0.26100.406110.0.26100.3981
Microsoft Windows 10=22H2
10.0.19045.5854
Microsoft Windows Server 2025<10.0.26100.4061, <10.0.26100.3981
10.0.26100.406110.0.26100.3981
Microsoft Windows 10=21H2
10.0.19044.5854
Microsoft Windows 10=22H2
10.0.19045.5854
Microsoft Windows 10=21H2
10.0.19044.5854
Microsoft Windows 11=22H2
10.0.22621.5335
Microsoft Windows Server 2022<10.0.20348.3692
10.0.20348.3692
Microsoft Windows Server 2022<10.0.20348.3692, <10.0.20348.3630
10.0.20348.369210.0.20348.3630
Microsoft Windows Server 2019<10.0.17763.7314
10.0.17763.7314
Microsoft Windows 10=1809
10.0.17763.7314
Microsoft Windows 11=23H2
10.0.22631.5335
Microsoft Windows Server 2019<10.0.17763.7314
10.0.17763.7314
Microsoft Windows 10=21H2
10.0.19044.5854
Microsoft Windows 10=1809
10.0.17763.7314

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.1.7601.27730Patch KB5061195
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.0.6003.23317Patch KB5061197
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.3.9600.22577Patch KB5058403
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.2.9200.25475Patch KB5058451
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.14393.8066Patch KB5058383
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.10240.21014Patch KB5058387
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.26100.4061Fixed in 10.0.26100.3981Patch KB5058497
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.25398.1611Patch KB5058384
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.22631.5335Patch KB5058405
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.19045.5854Patch KB5058379
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.22621.5335Patch KB5058405
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.19044.5854Patch KB5058379
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3692Patch KB5058385
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3692Fixed in 10.0.20348.3630Patch KB5058500
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.17763.7314Patch KB5058392
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3692Patch KB5058500
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.20348.3630Patch KB5058500
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.26100.4061Patch KB5058497
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.26100.3981Patch KB5058497
  20. Compensating control

    Follow applicable BOD 22-01 guidance for cloud services.

  21. Compensating control

    Discontinue use of the product if mitigations are unavailable.

Event History

May 13, 2025
CVE Published
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
Description
CVE Published
via MITRE·04:58 PM
Data Sourced
via MITRE·04:58 PM
DescriptionSeverity
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-32709?

CVE-2025-32709 is classified as a privilege escalation vulnerability.

2

How do I fix CVE-2025-32709?

To fix CVE-2025-32709, you should apply the latest security patches provided by Microsoft for your affected system.

3

What systems are affected by CVE-2025-32709?

CVE-2025-32709 affects various versions of Microsoft Windows including Windows 10, Windows 11, and Windows Server products.

4

Can exploiting CVE-2025-32709 lead to unauthorized access?

Yes, exploiting CVE-2025-32709 may allow an authorized attacker to elevate privileges locally, potentially leading to unauthorized access.

5

What is the mechanism behind CVE-2025-32709?

CVE-2025-32709 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203