---
title: "Windows AFD.sys and Storage Zero-Days, February 2025"
url: https://erroneo.us/security/briefs/windows-afd-storage-zero-days-cve-2025-21418-21391/
description: "CVE-2025-21418 (AFD.sys, SYSTEM) and CVE-2025-21391 (file deletion) were exploited before the Feb 11, 2025 fix. Confirm no host is behind."
type: security-brief
section: "Security Digest"
date_published: 2025-02-11
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-21418", "CVE-2025-21391"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows AFD.sys and Storage Zero-Days, February 2025

**Verdict: Check exposure.** Both bugs were exploited as zero-days but have been fixed in every cumulative update since February 2025; the remaining risk is unpatched or out-of-support Windows hosts, which also miss later AFD.sys zero-days.

- **Who must act:** Admins of any Windows 10, Windows 11 or Windows Server 2008 through 2025 host below the February 2025 builds, including Server 2008/2012 machines that dropped off Extended Security Updates.
- **Who can relax:** Fleets on the February 11, 2025 cumulative update or any later one; both fixes are included in every subsequent update.
- **Affected:** Windows 10 1507 / 1607 / 1809 / 21H2 / 22H2 before builds 10240.20915 / 14393.7785 / 17763.6893 / 19044.5487 / 19045.5487; Windows 11 22H2 / 23H2 before 22621.4890 / 22631.4890; Windows 11 24H2 before 26100.3194; Windows Server 2016 / 2019 / 2022 before 14393.7785 / 17763.6893 / 20348.3207; Server 2022 23H2 before 25398.1425; Server 2025 before 26100.3194; CVE-2025-21418 only: Windows Server 2008 SP2, 2008 R2 SP1, 2012 and 2012 R2 before the February 2025 updates
- **Fixed:** KB5051974 (Windows 10 21H2 and 22H2); KB5051989 (Windows 11 22H2 and 23H2); KB5051987 (Windows 11 24H2 and Server 2025); KB5051979 (Server 2022), KB5052000 (Windows 10 1809 / Server 2019), KB5052006 (Windows 10 1607 / Server 2016); Any later cumulative update
- **CVEs:** CVE-2025-21418, CVE-2025-21391
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the OS build on every Windows host and compare with the February 2025 fixed builds in the advisories.
2. Install the February 11, 2025 cumulative update or any later one wherever the build is lower; later updates also fix CVE-2025-32709 and CVE-2026-68820 in the same driver.
3. Find Server 2008 and 2012 machines without current Extended Security Updates and plan their replacement.
4. Patch multi-user systems first: RDS hosts, jump boxes and shared build servers where many people can run code.

### How to check if you are affected

- Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR.
- Hunt EDR telemetry for SYSTEM-level processes spawned from standard-user processes on hosts that were unpatched in early 2025.
- Look for unexplained deletion of files in protected locations (security tool, service or log folders) by low-privileged accounts, which matches what CVE-2025-21391 allows.

## What happened

On February 11, 2025, Microsoft's Patch Tuesday fixed two Windows bugs it had seen exploited in the wild. Neither was publicly disclosed before the fix. CISA added both to KEV the same day, with a March 4 deadline.

[CVE-2025-21418](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418) is a heap-based buffer overflow (CWE-122) in the Windows Ancillary Function Driver for WinSock, `afd.sys`. This kernel driver sits under Windows Sockets. A local user who exploits it gets SYSTEM. Microsoft scores it CVSS 3.1 7.8 and credits only "Anonymous".

[CVE-2025-21391](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391) is a link-following bug (CWE-59) in Windows Storage, scored 7.1. It is labeled elevation of privilege, but Microsoft's [FAQ](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Feb) is narrower: "An attacker would be able to delete targeted files on a system." It reveals no data. The deleted data could, however, include "data that results in the service being unavailable". Microsoft has not said how attackers used it.

Neither bug has been tied to a named attacker. [Tenable](https://www.tenable.com/blog/microsofts-february-2025-patch-tuesday-addresses-55-cves-cve-2025-21418-cve-2025-21391) wrote that there was "no other information about this exploitation" for either. It counted nine earlier AFD privilege-escalation bugs from 2022 to 2024, including CVE-2024-38193, which North Korea's Lazarus Group exploited to install the FudModule rootkit. Tenable called CVE-2025-21391 the first Windows Storage privilege-escalation bug exploited in the wild. As of Oct 23, 2026, no public write-up has named who exploited either bug in February 2025.

## Who is affected

Per the [CVE-2025-21418 record](https://www.cve.org/CVERecord?id=CVE-2025-21418), every supported Windows line at the time: Windows 10 1507 through 22H2, Windows 11 22H2 through 24H2, and Windows Server 2008 SP2 through 2025. The [CVE-2025-21391 record](https://www.cve.org/CVERecord?id=CVE-2025-21391) starts at Windows 10 and Server 2016. Fixed builds include 19045.5487 for Windows 10 22H2, 22631.4890 for Windows 11 23H2, 26100.3194 for Windows 11 24H2 and Server 2025, and 20348.3207 for Server 2022. [BleepingComputer](https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2025-patch-tuesday-fixes-4-zero-days-55-flaws/) lists KB5051974 for Windows 10 and KB5051987 and KB5051989 for Windows 11.

## Do you really need to act?

Only for machines that fell behind. Tenable describes both as exploitable by "a local, authenticated attacker", so someone must already be running code on the machine. Cumulative updates include earlier fixes, so anything patched since February 2025 is covered.

The AFD driver keeps coming back, though. Attackers exploited it again with [CVE-2025-32709](https://www.cve.org/CVERecord?id=CVE-2025-32709) in May 2025 and [CVE-2026-68820](https://www.cve.org/CVERecord?id=CVE-2026-68820) in August 2026. Our brief on the August bug covers that Lazarus campaign. A host fixed only for CVE-2025-21418 is still open to both. Old servers are the weak spot. [Microsoft says](https://learn.microsoft.com/en-us/lifecycle/announcements/windows-server-2012-r2-end-of-support) Extended Security Updates for Server 2012 and 2012 R2 run only until October 13, 2026.

## What to do now

1. Read each host's build with `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR` and compare it with the fixed builds.
2. Install the latest cumulative update, not just February 2025, so that the later AFD fixes are included.
3. Find Server 2008 and 2012 machines without current Extended Security Updates and schedule their replacement.
4. Patch shared machines first: RDS hosts, jump boxes and build servers where many users run code.

## How to tell if you were hit

Microsoft published no indicators for either bug. On hosts that were unpatched in early 2025, hunt EDR data for SYSTEM processes whose parent runs as a standard user. Also look for unexplained deletions by low-privileged accounts in protected folders, such as security tool, service or log directories. Treat any confirmed escalation as a full compromise and trace the initial access that came before it.

## Timeline

- Aug 13, 2024 — The earlier AFD zero-day CVE-2024-38193 is fixed.
- Feb 11, 2025 — Microsoft fixes CVE-2025-21418 and CVE-2025-21391 and marks both exploited. CISA adds them to KEV.
- Mar 4, 2025 — CISA's remediation deadline for federal agencies.
- May 13, 2025 — Another exploited AFD bug, CVE-2025-32709, is fixed.
- Aug 11, 2026 — CVE-2026-68820 in AFD is fixed after Lazarus exploitation.

## Sources

1. [Microsoft MSRC — CVE-2025-21418 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418)
2. [Microsoft MSRC — CVE-2025-21391 Windows Storage Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391)
3. [Microsoft MSRC — February 2025 Security Updates (CVRF data with FAQ, KB numbers and exploitation status)](https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Feb)
4. [CVE record — CVE-2025-21418](https://www.cve.org/CVERecord?id=CVE-2025-21418)
5. [CVE record — CVE-2025-21391](https://www.cve.org/CVERecord?id=CVE-2025-21391)
6. [NVD — CVE-2025-21418](https://nvd.nist.gov/vuln/detail/CVE-2025-21418)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-21418](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21418)
8. [CISA — Known Exploited Vulnerabilities: CVE-2025-21391](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21391)
9. [CVE record — CVE-2025-32709](https://www.cve.org/CVERecord?id=CVE-2025-32709)
10. [CVE record — CVE-2026-68820](https://www.cve.org/CVERecord?id=CVE-2026-68820)
11. [Microsoft Learn — Windows Server 2012 and 2012 R2 reaching end of support](https://learn.microsoft.com/en-us/lifecycle/announcements/windows-server-2012-r2-end-of-support)
12. [Tenable — Microsoft's February 2025 Patch Tuesday Addresses 55 CVEs (CVE-2025-21418, CVE-2025-21391)](https://www.tenable.com/blog/microsofts-february-2025-patch-tuesday-addresses-55-cves-cve-2025-21418-cve-2025-21391)
13. [BleepingComputer — Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws](https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2025-patch-tuesday-fixes-4-zero-days-55-flaws/)

---
Source page: https://erroneo.us/security/briefs/windows-afd-storage-zero-days-cve-2025-21418-21391/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt