CriticalCVE-2025-21418

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVE-2025-21418)

    Published In CISA KEV since Sources: CVE.org, Msrc Update Guide, pwn.watch

    What is affected, what to do

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Windows 10 Version 1507 to version 10.0.10240.20915, Microsoft Windows 10 Version 1607 to version 10.0.14393.7785, Microsoft Windows 10 Version 1809 to version 10.0.17763.6893. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Microsoft Windows 10 Version 1507 lt 10.0.10240.0..10.0.10240.20915
    • Microsoft Windows 10 Version 1607 lt 10.0.14393.0..10.0.14393.7785
    • Microsoft Windows 10 Version 1809 lt 10.0.17763.0..10.0.17763.6893
    • Microsoft Windows 10 Version 21H2 lt 10.0.19044.0..10.0.19044.5487
    • Microsoft Windows 10 Version 22H2 lt 10.0.19045.0..10.0.19045.5487
    • Microsoft Windows 11 version 22H2 lt 10.0.22621.0..10.0.22621.4890
    • Microsoft Windows 11 version 22H3 lt 10.0.22631.0..10.0.22631.4890
    • Microsoft Windows 11 Version 23H2 lt 10.0.22631.0..10.0.22631.4890
    • Microsoft Windows 11 Version 24H2 lt 10.0.26100.0..10.0.26100.3194
    • Microsoft Windows Server 2008 R2 Service Pack 1 lt 6.1.7601.0..6.1.7601.27566
    • Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) lt 6.1.7601.0..6.1.7601.27566
    • Microsoft Windows Server 2008 Service Pack 2 lt 6.0.6003.0..6.0.6003.23117
    • Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) lt 6.0.6003.0..6.0.6003.23117
    • Microsoft Windows Server 2012 lt 6.2.9200.0..6.2.9200.25317
    • Microsoft Windows Server 2012 (Server Core installation) lt 6.2.9200.0..6.2.9200.25317
    • Microsoft Windows Server 2012 R2 lt 6.3.9600.0..6.3.9600.22417
    • Microsoft Windows Server 2012 R2 (Server Core installation) lt 6.3.9600.0..6.3.9600.22417
    • Microsoft Windows Server 2016 lt 10.0.14393.0..10.0.14393.7785
    • Microsoft Windows Server 2016 (Server Core installation) lt 10.0.14393.0..10.0.14393.7785
    • Microsoft Windows Server 2019 lt 10.0.17763.0..10.0.17763.6893
    • Microsoft Windows Server 2019 (Server Core installation) lt 10.0.17763.0..10.0.17763.6893
    • Microsoft Windows Server 2022 lt 10.0.20348.0..10.0.20348.3207
    • Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) lt 10.0.25398.0..10.0.25398.1425
    • Microsoft Windows Server 2025 lt 10.0.26100.0..10.0.26100.3194
    • Microsoft Windows Server 2025 (Server Core installation) lt 10.0.26100.0..10.0.26100.3194
    Fixed in
    • Microsoft Windows 10 Version 1507 10.0.10240.20915
    • Microsoft Windows 10 Version 1607 10.0.14393.7785
    • Microsoft Windows 10 Version 1809 10.0.17763.6893
    • Microsoft Windows 10 Version 21H2 10.0.19044.5487
    • Microsoft Windows 10 Version 22H2 10.0.19045.5487
    • Microsoft Windows 11 version 22H2 10.0.22621.4890
    • Microsoft Windows 11 version 22H3 10.0.22631.4890
    • Microsoft Windows 11 Version 23H2 10.0.22631.4890
    • Microsoft Windows 11 Version 24H2 10.0.26100.3194
    • Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.27566
    • Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.27566
    • Microsoft Windows Server 2008 Service Pack 2 6.0.6003.23117
    • Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) 6.0.6003.23117
    • Microsoft Windows Server 2012 6.2.9200.25317
    • Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.25317
    • Microsoft Windows Server 2012 R2 6.3.9600.22417
    • Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.22417
    • Microsoft Windows Server 2016 10.0.14393.7785
    • Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.7785
    • Microsoft Windows Server 2019 10.0.17763.6893
    • Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.6893
    • Microsoft Windows Server 2022 10.0.20348.3207
    • Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.1425
    • Microsoft Windows Server 2025 10.0.26100.3194
    • Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.3194

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    7.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    7.8

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: CVE.org, Msrc Update Guide, pwn.watch

    2.1 %

    EPSS score

    Moderate — model estimates 1-10% exploitation likelihood.

    Source: FIRST EPSS, percentile 81.9

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    200.52 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab) How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    7.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    7.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    2.1 %
    Moderate — model estimates 1-10% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    81.9
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 12 February 2025
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-122

    Response and mitigation

    Why act now?

    Prioritisation rationale

    CISA added this CVE to KEV on patch day, which means it was exploited as a zero-day. Attackers use it as a reliable privilege-escalation stage after initial access through phishing, stolen credentials or hijacked user sessions. It is local-only but needs only low privileges and no user interaction, and it yields full compromise of confidentiality, integrity and availability. Exploitation likelihood is moderate to elevated, and CISA has not flagged ransomware use. For NIS2-scoped organisations with large Windows client estates, especially those running RDS or VDI, this belongs in the emergency patch cycle within days. Rate it high where session hosts or admin systems are exposed, and medium-high otherwise.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Prioritise rollout of the February 2025 security update (Patch Tuesday, 11 Feb 2025). Target builds per context: Windows 10 1507 → 10.0.10240.20915, 1607 → 10.0.14393.7785, 1809 → 10.0.17763.6893, 21H2/22H2 → 10.0.19044.5487 / 10.0.19045.5487, Windows 11 22H2 → 10.0.22621.4890, 23H2 → 10.0.22631.4890. Look up the matching KB numbers in the Microsoft Security Update Guide entry for CVE-2025-21418. Any later cumulative update also contains the fix.
      • Patch multi-user hosts first: RDS/VDI session hosts, Citrix workers, jump hosts, build servers and admin workstations. Many low-privileged users share these machines, so a local escalation to SYSTEM does the most damage there.
      • Verify coverage for Windows Server and Windows 11 24H2. The context does not list them. Check the vendor advisory rather than assuming they are unaffected.
      • Pull an exposure inventory from Intune, SCCM/MECM or Defender Vulnerability Management covering every endpoint below the builds above. Log any unpatchable systems (EoL 1507/1607 outside LTSB/LTSC) as tracked exceptions with a named owner.
      • Network-isolate hosts that already have open EDR alerts (phishing payloads, loaders). This bug is typically chained as stage two after initial access.

    2. Runbook step 2

      Mitigation layers

      • No configuration workaround exists. afd.sys is a core Windows networking driver and cannot be disabled. Compensating controls therefore have to stop local code execution in the first place.
      • Application control (endpoint hardening): Enforce WDAC or AppLocker on user-writable paths (%TEMP%, %APPDATA%, Downloads, \Users\Public). Block unsigned binaries from those locations to break the typical "drop exploit binary and run" step.
      • Enable Defender ASR rules: "Block executable files unless they meet prevalence, age, or trusted list criteria", "Block Office applications from creating child processes" and "Block credential stealing from LSASS".
      • Limit what SYSTEM buys an attacker (IAM/least privilege): Turn on LSA Protection (RunAsPPL) and Credential Guard. Enforce admin tiering so no Domain Admin logs on to workstations or session hosts. Use Windows LAPS for unique local admin passwords.
      • Network segmentation: Block client-to-client SMB (445/TCP), WinRM (5985/5986/TCP) and RDP (3389/TCP) so a local SYSTEM foothold does not immediately turn into lateral movement.
      • Enable the vulnerable driver blocklist and HVCI/Memory Integrity to make follow-on kernel tampering (BYOVD, EDR killing) harder.

    3. Runbook step 3

      Detection rules

      • Integrity jump in process ancestry (Sysmon EID 1 / Security 4688): a SYSTEM-integrity child spawned by a Medium- or Low-integrity user process, typically one running from a user path. KQL: DeviceProcessEvents | where ProcessIntegrityLevel=="System" and InitiatingProcessIntegrityLevel in ("Medium","Low") and InitiatingProcessFolderPath has_any (@"\Users\",@"\Temp\")
      • SYSTEM shells without a legitimate service parent: cmd.exe, powershell.exe or rundll32.exe running as NT AUTHORITY\SYSTEM whose parent is not services.exe, svchost.exe, wininit.exe or a known management agent. Build this as a Sigma process_creation rule with a ParentImage allowlist.
      • Failed exploitation attempts: bugchecks referencing afd.sys. Watch System Event ID 1001 (BugCheck) and 41 (Kernel-Power), and triage crash dumps for the faulting module. Repeated crashes on a single client are a strong signal.
      • Post-escalation activity within minutes of a suspicious user process:
        • new service creation (System 7045 / Security 4697)
        • LSASS access (Sysmon EID 10, TargetImage=lsass.exe, GrantedAccess 0x1010/0x1FFFFF)
        • Defender tampering (Event 5001)
        • Security log clearing (1102)
      • EDR telemetry: escalate kernel exploit, token-manipulation or token-stealing alerts to critical whenever they fire on an unpatched build.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Source: cvelistv5, NVD (NIST), Microsoft Security Update Guide, CISA KEV Catalog, CVE.org (MITRE), pwn.watch

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    MicrosoftWindows 10 Version 1507
    • 10.0.10240.0 – < 10.0.10240.20915
    • 10.0.10240.20915
    MicrosoftWindows 10 Version 1607
    • 10.0.14393.0 – < 10.0.14393.7785
    • 10.0.14393.7785
    MicrosoftWindows 10 Version 1809
    • 10.0.17763.0 – < 10.0.17763.6893
    • 10.0.17763.6893
    MicrosoftWindows 10 Version 21H2
    • 10.0.19044.0 – < 10.0.19044.5487
    • 10.0.19044.5487
    MicrosoftWindows 10 Version 22H2
    • 10.0.19045.0 – < 10.0.19045.5487
    • 10.0.19045.5487
    MicrosoftWindows 11 version 22H2
    • 10.0.22621.0 – < 10.0.22621.4890
    • 10.0.22621.4890
    MicrosoftWindows 11 version 22H3
    • 10.0.22631.0 – < 10.0.22631.4890
    • 10.0.22631.4890
    MicrosoftWindows 11 Version 23H2
    • 10.0.22631.0 – < 10.0.22631.4890
    • 10.0.22631.4890
    MicrosoftWindows 11 Version 24H2
    • 10.0.26100.0 – < 10.0.26100.3194
    • 10.0.26100.3194
    MicrosoftWindows Server 2008 R2 Service Pack 1
    • 6.1.7601.0 – < 6.1.7601.27566
    • 6.1.7601.27566
    MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)
    • 6.1.7601.0 – < 6.1.7601.27566
    • 6.1.7601.27566
    MicrosoftWindows Server 2008 Service Pack 2
    • 6.0.6003.0 – < 6.0.6003.23117
    • 6.0.6003.23117
    MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)
    • 6.0.6003.0 – < 6.0.6003.23117
    • 6.0.6003.23117
    MicrosoftWindows Server 2012
    • 6.2.9200.0 – < 6.2.9200.25317
    • 6.2.9200.25317
    MicrosoftWindows Server 2012 (Server Core installation)
    • 6.2.9200.0 – < 6.2.9200.25317
    • 6.2.9200.25317
    MicrosoftWindows Server 2012 R2
    • 6.3.9600.0 – < 6.3.9600.22417
    • 6.3.9600.22417
    MicrosoftWindows Server 2012 R2 (Server Core installation)
    • 6.3.9600.0 – < 6.3.9600.22417
    • 6.3.9600.22417
    MicrosoftWindows Server 2016
    • 10.0.14393.0 – < 10.0.14393.7785
    • 10.0.14393.7785
    MicrosoftWindows Server 2016 (Server Core installation)
    • 10.0.14393.0 – < 10.0.14393.7785
    • 10.0.14393.7785
    MicrosoftWindows Server 2019
    • 10.0.17763.0 – < 10.0.17763.6893
    • 10.0.17763.6893
    MicrosoftWindows Server 2019 (Server Core installation)
    • 10.0.17763.0 – < 10.0.17763.6893
    • 10.0.17763.6893
    MicrosoftWindows Server 2022
    • 10.0.20348.0 – < 10.0.20348.3207
    • 10.0.20348.3207
    MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)
    • 10.0.25398.0 – < 10.0.25398.1425
    • 10.0.25398.1425
    MicrosoftWindows Server 2025
    • 10.0.26100.0 – < 10.0.26100.3194
    • 10.0.26100.3194
    MicrosoftWindows Server 2025 (Server Core installation)
    • 10.0.26100.0 – < 10.0.26100.3194
    • 10.0.26100.3194

    Vendors and products

    Affected operating systems

    Affected operating systems
    Windowsmicrosoftwindows_10_1607—
    Windowsmicrosoftwindows_10_1809—
    Windowsmicrosoftwindows_10_21h2—
    Windowsmicrosoftwindows_10_22h2—
    Windowsmicrosoftwindows_11_22h2—
    Windowsmicrosoftwindows_11_23h2—
    Windowsmicrosoftwindows_11_24h2—
    Windowsmicrosoftwindows_server_2008r2
    Windowsmicrosoftwindows_server_2008—
    Windowsmicrosoftwindows_server_2012r2
    Windowsmicrosoftwindows_server_2012—
    Windowsmicrosoftwindows_server_2016—
    Windowsmicrosoftwindows_server_2019—
    Windowsmicrosoftwindows_server_2022—
    Windowsmicrosoftwindows_server_2022_23h2—
    Windowsmicrosoftwindows_server_2025—

    Weakness classes (CWE)

    • CWE-122Heap-based Buffer Overflow

      Variant

      A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

      Entry at MITRE CWE-122

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited

    References & sources

    • Microsoft Security Update GuideWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityVendor advisory, Patch, Patch, Vendor advisory, pwn-watch
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21418government-resource, US government resource
    • pwn.watchpwn.watch: Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)pwn-watch
    • Microsoft Security Update GuideMicrosoft advisory: Microsoft Windowspwn-watch
    • NVD (NIST)NVD: CVE-2025-21391pwn-watch
    • NVD (NIST)NVD: CVE-2025-21418pwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2025-21418
    <a href="https://intel.neosec.eu/en/cve/CVE-2025-21418"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-21418.svg?lang=en" alt="CVE-2025-21418 – NEOSEC Intel" height="20"></a>