Windows AFD.sys and Storage Zero-Days, February 2025

What to do

1. Check the OS build on every Windows host and compare with the February 2025 fixed builds in the advisories.
2. Install the February 11, 2025 cumulative update or any later one wherever the build is lower; later updates also fix CVE-2025-32709 and CVE-2026-68820 in the same driver.
3. Find Server 2008 and 2012 machines without current Extended Security Updates and plan their replacement.
4. Patch multi-user systems first: RDS hosts, jump boxes and shared build servers where many people can run code.

How to check if you are affected or compromised

• Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR.
• Hunt EDR telemetry for SYSTEM-level processes spawned from standard-user processes on hosts that were unpatched in early 2025.
• Look for unexplained deletion of files in protected locations (security tool, service or log folders) by low-privileged accounts, which matches what CVE-2025-21391 allows.

What happened#

On February 11, 2025, Microsoft's Patch Tuesday fixed two Windows bugs it had seen exploited in the wild. Neither was publicly disclosed before the fix. CISA added both to KEV the same day, with a March 4 deadline.

CVE-2025-21418 is a heap-based buffer overflow (CWE-122) in the Windows Ancillary Function Driver for WinSock, afd.sys. This kernel driver sits under Windows Sockets. A local user who exploits it gets SYSTEM. Microsoft scores it CVSS 3.1 7.8 and credits only "Anonymous".

CVE-2025-21391 is a link-following bug (CWE-59) in Windows Storage, scored 7.1. It is labeled elevation of privilege, but Microsoft's FAQ is narrower: "An attacker would be able to delete targeted files on a system." It reveals no data. The deleted data could, however, include "data that results in the service being unavailable". Microsoft has not said how attackers used it.

Neither bug has been tied to a named attacker. Tenable wrote that there was "no other information about this exploitation" for either. It counted nine earlier AFD privilege-escalation bugs from 2022 to 2024, including CVE-2024-38193, which North Korea's Lazarus Group exploited to install the FudModule rootkit. Tenable called CVE-2025-21391 the first Windows Storage privilege-escalation bug exploited in the wild. As of Oct 23, 2026, no public write-up has named who exploited either bug in February 2025.

Who is affected#

Per the CVE-2025-21418 record, every supported Windows line at the time: Windows 10 1507 through 22H2, Windows 11 22H2 through 24H2, and Windows Server 2008 SP2 through 2025. The CVE-2025-21391 record starts at Windows 10 and Server 2016. Fixed builds include 19045.5487 for Windows 10 22H2, 22631.4890 for Windows 11 23H2, 26100.3194 for Windows 11 24H2 and Server 2025, and 20348.3207 for Server 2022. BleepingComputer lists KB5051974 for Windows 10 and KB5051987 and KB5051989 for Windows 11.

Do you really need to act?#

Only for machines that fell behind. Tenable describes both as exploitable by "a local, authenticated attacker", so someone must already be running code on the machine. Cumulative updates include earlier fixes, so anything patched since February 2025 is covered.

The AFD driver keeps coming back, though. Attackers exploited it again with CVE-2025-32709 in May 2025 and CVE-2026-68820 in August 2026. Our brief on the August bug covers that Lazarus campaign. A host fixed only for CVE-2025-21418 is still open to both. Old servers are the weak spot. Microsoft says Extended Security Updates for Server 2012 and 2012 R2 run only until October 13, 2026.

What to do now#

1. Read each host's build with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and compare it with the fixed builds.
2. Install the latest cumulative update, not just February 2025, so that the later AFD fixes are included.
3. Find Server 2008 and 2012 machines without current Extended Security Updates and schedule their replacement.
4. Patch shared machines first: RDS hosts, jump boxes and build servers where many users run code.

How to tell if you were hit#

Microsoft published no indicators for either bug. On hosts that were unpatched in early 2025, hunt EDR data for SYSTEM processes whose parent runs as a standard user. Also look for unexplained deletions by low-privileged accounts in protected folders, such as security tool, service or log directories. Treat any confirmed escalation as a full compromise and trace the initial access that came before it.

Timeline#

• Aug 13, 2024 — The earlier AFD zero-day CVE-2024-38193 is fixed.
• Feb 11, 2025 — Microsoft fixes CVE-2025-21418 and CVE-2025-21391 and marks both exploited. CISA adds them to KEV.
• Mar 4, 2025 — CISA's remediation deadline for federal agencies.
• May 13, 2025 — Another exploited AFD bug, CVE-2025-32709, is fixed.
• Aug 11, 2026 — CVE-2026-68820 in AFD is fixed after Lazarus exploitation.

Vulnerability records

• CVE-2025-21418 · KEV 2025-02-11 · Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
• CVE-2025-21391 · KEV 2025-02-11 · Windows Storage Elevation of Privilege Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-21418 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — CVE-2025-21391 Windows Storage Elevation of Privilege Vulnerability msrc.microsoft.com
3. Microsoft MSRC — February 2025 Security Updates (CVRF data with FAQ, KB numbers and exploitation status) api.msrc.microsoft.com
4. CVE record — CVE-2025-21418 cve.org
5. CVE record — CVE-2025-21391 cve.org
6. NVD — CVE-2025-21418 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2025-21418 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2025-21391 cisa.gov
9. CVE record — CVE-2025-32709 cve.org
10. CVE record — CVE-2026-68820 cve.org
11. Microsoft Learn — Windows Server 2012 and 2012 R2 reaching end of support learn.microsoft.com
12. Tenable — Microsoft's February 2025 Patch Tuesday Addresses 55 CVEs (CVE-2025-21418, CVE-2025-21391) tenable.com

Coverage and analysis

1. BleepingComputer — Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws bleepingcomputer.com