Veille CVE
CVE-2025-24983
7.0 Élevée Exploitée activementCatalogue CISA KEV — Microsoft Windows Win32k Use-After-Free Vulnerability
Ajoutée le 11/03/2025 · Échéance de correction (agences US) : 01/04/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
Produits concernés
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- Microsoft Windows Server 2008 R2 Service Pack 1
- Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
- Microsoft Windows Server 2008 Service Pack 2
- Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)
- Microsoft Windows Server 2012
- Microsoft Windows Server 2012 (Server Core installation)
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2012 R2 (Server Core installation)
- Microsoft Windows Server 2016
- Microsoft Windows Server 2016 (Server Core installation)
- Microsoft windows 10 1507
- Microsoft windows 10 1607
- Microsoft windows server 2008
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.0 Élevée | secure@microsoft.com | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983 PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24983 US Government Resource