Windows CLFS Zero-Day Vulnerability Actively Exploited in the Wild

Microsoft has disclosed two critical security vulnerabilities in the Windows Common Log File System (CLFS) Driver that are currently being exploited in the wild.

Released on May 13, 2025, the vulnerabilities-identified as CVE-2025-32706 and CVE-2025-32701-both allow local privilege escalation and have been classified as “Important” with high CVSS scores of 7.8.

These zero-day vulnerabilities represent a significant threat as Microsoft has confirmed active exploitation, indicating attackers are already leveraging these flaws in real-world attacks.

The first vulnerability (CVE-2025-32706) stems from improper input validation in the Windows Common Log File System Driver.

“Categorized under the common weakness enumeration CWE-20, this vulnerability allows a locally authenticated attacker to execute malicious code with elevated” system privileges.

The flaw occurs when the CLFS driver fails to properly validate input before processing it, creating an exploitable condition that bypasses intended security controls.

The second vulnerability (CVE-2025-32701) involves a Use-After-Free (UAF) condition, classified as CWE-416, in the same CLFS Driver component.

This memory corruption vulnerability occurs when the application continues to use a memory location after it has been freed, potentially allowing an attacker to execute arbitrary code.

Both vulnerabilities share the same CVSS vector string , indicating they require local access, low attack complexity, and low privileges, but can result in complete compromise of confidentiality, integrity, and availability.

Exploitation Status and Attack Vector

Microsoft’s security advisory confirms that both vulnerabilities are being actively exploited, making them true zero-day vulnerabilities.

The attack vector requires an attacker to already have local access to the target system and low-level privileges.

Once exploited, however, the attacker can elevate their privileges to SYSTEM level, effectively gaining complete control over the affected machine.

The “Exploitation Detected” status in Microsoft’s advisory suggests that their threat intelligence has identified these vulnerabilities being used in targeted attacks.

The exploitability assessment indicates that these are particularly dangerous flaws with a “Exploitation Detected” classification and a rating of “Exploitation More Likely” based on the CVSS exploitability metrics.

The local attack vector means that while remote exploitation isn’t possible, these vulnerabilities are particularly valuable in multi-stage attack chains where an attacker has already gained initial access to a system through other means.

Recommendations and Defensive Measures

Organizations should immediately apply the security updates provided in Microsoft’s May 2025 Patch Tuesday release.

Given the active exploitation status, patching should be prioritized for all Windows systems, particularly those in high-security environments.

Microsoft has issued Official (RL:O) remediation through their security patches, and the report confidence (RC:C) is listed as confirmed.

For systems that cannot be immediately patched, security teams should implement additional defensive measures, including:

• Limiting local user privileges using the principle of least privilege.
• Monitoring for suspicious process activity related to the CLFS driver.
• Implementing application control policies to prevent unauthorized executables from running.
• Deploying advanced endpoint detection and response (EDR) solutions capable of detecting exploitation patterns.

The Windows Common Log File System Driver vulnerabilities represent a serious security threat that requires immediate attention from all organizations running Windows systems, especially given their confirmed exploitation in the wild.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!