CVE-2025-32706 | THREATINT

Description

Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

PUBLISHED Reserved 2025-04-09 | Published 2025-05-13 | Updated 2026-02-26 | Assigner microsoft

HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CISA Known Exploited Vulnerability

Date added 2025-05-13 | Due date 2025-06-03

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-20: Improper Input Validation

Product status

10.0.10240.0 (custom) before 10.0.10240.21014

affected

10.0.14393.0 (custom) before 10.0.14393.8066

affected

10.0.17763.0 (custom) before 10.0.17763.7314

affected

10.0.19044.0 (custom) before 10.0.19044.5854

affected

10.0.19045.0 (custom) before 10.0.19045.5854

affected

10.0.22621.0 (custom) before 10.0.22621.5335

affected

10.0.22631.0 (custom) before 10.0.22631.5335

affected

10.0.22631.0 (custom) before 10.0.22631.5335

affected

10.0.26100.0 (custom) before 10.0.26100.4061

affected

6.1.7601.0 (custom) before 6.1.7601.27729

affected

6.1.7601.0 (custom) before 6.1.7601.27729

affected

6.0.6003.0 (custom) before 6.0.6003.23279

affected

6.0.6003.0 (custom) before 6.0.6003.23279

affected

6.2.9200.0 (custom) before 6.2.9200.25475

affected

6.2.9200.0 (custom) before 6.2.9200.25475

affected

6.3.9600.0 (custom) before 6.3.9600.22577

affected

6.3.9600.0 (custom) before 6.3.9600.22577

affected

10.0.14393.0 (custom) before 10.0.14393.8066

affected

10.0.14393.0 (custom) before 10.0.14393.8066

affected

10.0.17763.0 (custom) before 10.0.17763.7314

affected

10.0.17763.0 (custom) before 10.0.17763.7314

affected

10.0.20348.0 (custom) before 10.0.20348.3692

affected

10.0.25398.0 (custom) before 10.0.25398.1611

affected

10.0.26100.0 (custom) before 10.0.26100.4061

affected

10.0.26100.0 (custom) before 10.0.26100.4061

affected

References

www.cisa.gov/...erabilities-catalog?field_cve=CVE-2025-32706 government-resource

www.vicarius.io/...oft-windows-common-log-file-system-driver

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32706 (Windows Common Log File System Driver Elevation of Privilege Vulnerability) vendor-advisory patch

cve.org (CVE-2025-32706)

nvd.nist.gov (CVE-2025-32706)

Download JSON