CVE Vulnerability Advisory Database

[Affected Scope] All supported versions of Microsoft Windows and Windows Server utilizing the Common Log File System (CLFS) driver.

[Impact] An authorized local attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host compromise.

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local interactive access.

[Affected Scope] Desktop Window Manager (DWM) component in Microsoft Windows 10, Windows 11, and Windows Server operating systems

[Impact] An authorized local attacker can exploit a Use-After-Free vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host takeover

[Mitigation] Immediately apply the official Microsoft cumulative security updates and monitor unpatched systems for anomalous DWM crashes

[Affected Scope] Windows operating systems and applications utilizing the Microsoft Scripting Engine

[Impact] Unauthorized remote attackers can execute arbitrary code and compromise system integrity via crafted web content or documents

[Mitigation] Immediately apply the official Microsoft security updates and restrict untrusted script execution policies

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing the Common Log File System (CLFS.sys) driver.

[Impact] An authorized local attacker can execute arbitrary code in kernel mode and elevate privileges to NT AUTHORITY\SYSTEM.

[Mitigation] Immediately apply the latest cumulative security updates released by Microsoft (March 2025 Patch Tuesday or later).

[Affected Scope] Google Chrome on Windows prior to version 134.0.6998.177

[Impact] A remote attacker can exploit incorrect handle validation in the Mojo IPC framework via a malicious file to escape the browser sandbox and execute arbitrary code with elevated privileges

[Mitigation] Immediately update Google Chrome to the latest stable channel (134.0.6998.177 or higher) and enforce auto-updates via Group Policy (GPO)

[Affected Scope] Microsoft Management Console (MMC) component across various supported Microsoft Windows operating systems

[Impact] Local attackers can bypass critical security boundaries and Mark-of-the-Web (MotW) protections via user interaction, potentially leading to privilege escalation and arbitrary code execution

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict the execution of untrusted .msc files using AppLocker or WDAC

[Affected Scope] Systems running Windows Operating Systems utilizing the NTFS file system driver (ntfs.sys)

[Impact] A local authorized attacker can exploit this vulnerability to trigger a heap-based buffer overflow, leading to local privilege escalation (LPE) and arbitrary code execution with SYSTEM privileges

[Mitigation] Immediately apply the latest Microsoft cumulative security updates and restrict the mounting of untrusted external storage media and disk images

[Affected Scope] Windows 10, Windows 11, and Windows Server families utilizing the NTFS file system driver

[Impact] Local authorized attackers can disclose sensitive kernel memory information, potentially facilitating subsequent privilege escalation (EoP) attacks

[Mitigation] Immediately apply the February 2025 Microsoft Patch Tuesday security updates and restrict local access for unauthorized users

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Fast FAT File System Driver (fastfat.sys)

[Impact] Local unauthorized attackers can execute arbitrary code with SYSTEM privileges by exploiting kernel-level memory corruption

[Mitigation] Apply the official Microsoft security updates immediately, or restrict auto-mounting of untrusted storage media and virtual disk images

[Affected Scope] All Windows operating system deployments utilizing the NTFS file system

[Impact] An unauthorized attacker with physical access can extract sensitive information written in plaintext within NTFS system log files

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and enforce BitLocker Full Disk Encryption (FDE)

[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Win32k kernel subsystem

[Impact] An authorized local attacker can elevate privileges to SYSTEM level, gaining full control over the affected system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local access

[Affected Scope] Active Directory environments and Windows operating systems utilizing the NTLM authentication protocol

[Impact] Unauthorized remote attackers can control file names or paths to perform network-based spoofing and credential relay attacks

[Mitigation] Apply the latest Microsoft cumulative security updates and restrict NTLM authentication traffic

[Affected Scope] All supported versions of Windows 10, 11, and Windows Server utilizing the WinSock Ancillary Function Driver (afd.sys)

[Impact] Local attackers can trigger kernel memory corruption (Heap-based Buffer Overflow) to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft February 2025 Patch Tuesday cumulative updates and restrict unauthorized local execution privileges

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing Windows Storage components

[Impact] Local attackers with low privileges can exploit symbolic link creation to overwrite critical system files, leading to arbitrary code execution with SYSTEM privileges

[Mitigation] Apply the Microsoft February 2025 security updates immediately and restrict local symbolic link creation privileges on unpatched systems

[Affected Scope] Windows Server and Desktop operating systems running Windows Hyper-V virtualization environments

[Impact] A local attacker with low privileges can exploit a Use-After-Free (UAF) vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Immediately apply the February 2025 Microsoft Patch Tuesday security updates and restrict local access to virtualization hosts

[Affected Scope] Windows 10, 11, and Windows Server systems with the Hyper-V virtualization role enabled

[Impact] Local attackers can exploit a Use-After-Free (UAF) vulnerability to execute arbitrary code with kernel-level (SYSTEM) privileges, leading to complete host compromise

[Mitigation] Immediately apply the February 2025 Microsoft Cumulative Security Updates and disable unnecessary Hyper-V services

[Affected Scope] Windows Server and Desktop operating systems with the Windows Hyper-V virtualization role enabled

[Impact] A local attacker can exploit a heap-based buffer overflow (CWE-122) to execute arbitrary code with SYSTEM privileges, leading to complete host compromise

[Mitigation] Apply the official Microsoft security patches immediately, or temporarily disable non-essential Hyper-V services to reduce the attack surface

[Affected Scope] Windows 10, 11, and Windows Server systems utilizing the Common Log File System (CLFS) driver

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, escalating privileges to SYSTEM

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict unauthorized creation of CLFS log (.blf) files

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] A local attacker with low privileges can bypass security boundaries via RPC interfaces to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the Microsoft November 2024 Security Update and restrict local user privileges

[Affected Scope] All supported versions of Microsoft Windows and Windows Server operating systems

[Impact] Simple user interaction with a malicious file (such as right-clicking or selecting) triggers NTLM credential disclosure, enabling credential theft and NTLM Relay attacks

[Mitigation] Immediately apply the Microsoft November 2024 cumulative security updates and restrict outbound NTLM traffic via Group Policy and firewalls