Windows CLFS CVE-2025-29824: Ransomware Zero-Day EoP

What to do

1. Confirm every Windows host runs the April 8, 2025 cumulative update or later by comparing its build and revision with the fixed builds.
2. Patch or isolate stragglers: Windows 10 without Extended Security Updates and old Server 2008/2012 boxes no longer get fixes at all.
3. Search hosts for C:\ProgramData\SkyPDF\PDUDrv.blf and the ransom note !_READ_ME_REXX2_!.txt.
4. Hunt for procdump or dllhost.exe dumping lsass.exe, and for bcdedit, wbadmin and wevtutil commands that disable recovery or clear logs.
5. Treat a host with these traces as a ransomware intrusion: rebuild it and reset every credential that touched it.

How to check if you are affected or compromised

• Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, and compare with the fixed builds.
• Look for C:\ProgramData\SkyPDF\PDUDrv.blf, a CLFS log file both Microsoft and Symantec list as an exploitation artifact.
• Search EDR history for Defender detections SilverBasket, MSBuildInlineTaskLoader.C and SuspClfsAccess, and for certutil downloading an MSBuild file.
• Look in user Music folders for paloaltoconfig.exe, paloaltoconfig.dll, 1day.exe, go.exe and cmdpostfix.bat from Symantec's Play ransomware report.

What happened#

On April 8, 2025, Microsoft's Patch Tuesday fixed CVE-2025-29824, a use-after-free (CWE-416) in the Windows Common Log File System (CLFS) kernel driver. A user who can already run code on a machine can use it to gain SYSTEM. Microsoft rates it Important, CVSS 3.1 7.8, and marked it exploited. The Microsoft Threat Intelligence Center found it. CISA added it to the KEV catalog the same day and flags known ransomware use.

Microsoft's write-up ties the exploitation to Storm-2460 and "a small number of targets": IT and real estate firms in the US, a financial firm in Venezuela, a Spanish software company and a Saudi retailer. The actor used certutil to fetch a malicious MSBuild file from a hacked legitimate site, which unpacked the PipeMagic backdoor. The exploit ran in memory from dllhost.exe, overwrote the process token and left C:\ProgramData\SkyPDF\PDUDrv.blf behind. The crew then dumped LSASS with procdump and ran RansomEXX-linked ransomware that wrote !_READ_ME_REXX2_!.txt. Microsoft says the observed exploit did not work on Windows 11 24H2, though the bug is present there.

A second crew had it too. On May 7, 2025, Symantec reported that Balloonfly, the group behind Play ransomware, used a CVE-2025-29824 exploit against a US organization before the patch. Entry was likely a public-facing Cisco ASA. No ransomware ran, but the attackers deployed the Grixba infostealer. Symantec says the exploit "may have been in the hands of multiple actors" before the fix.

Who is affected#

The CVE record lists every Windows line then supported, from Windows 10 1507 and Server 2008 SP2 through Windows 11 24H2 and Server 2025. Fixed builds include 19045.5737 for Windows 10 22H2, 22631.5189 for Windows 11 23H2, 26100.3775 for Windows 11 24H2 and Server 2025, and 20348.3453 for Server 2022. The Windows 10 1507 package, KB5055547, arrived a day late, on April 9, per the April CVRF data and the advisory's revision history.

Do you really need to act?#

For most fleets, no. Any Windows machine patched since April 2025 is covered, because cumulative updates carry earlier fixes. The risk sits in machines that stopped patching. Windows 10 reached end of support on October 14, 2025, and devices without Extended Security Updates get no new fixes. A host that stalled before April 2025 is open to this bug and everything since.

This is a second-stage bug: the attacker must already run code. But it was used by two ransomware operations, and CLFS has been a repeated target, with another exploited CLFS zero-day, CVE-2024-49138, fixed in December 2024. After an unexplained 2025 intrusion, check for these traces.

What to do now#

1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, or your patch tool, and compare with the fixed builds above.
2. Install the current cumulative update on anything behind. Isolate or retire Windows 10 and Server 2008/2012 machines that no longer receive fixes.
3. Run Test-Path 'C:\ProgramData\SkyPDF\PDUDrv.blf' across the fleet and search for !_READ_ME_REXX2_!.txt.
4. Rebuild any host with these traces and reset credentials that were used on it, since LSASS was dumped.

How to tell if you were hit#

• Search EDR for dllhost.exe -accepteula -r -ma lsass.exe, procdump runs and dllhost.exe --do.
• Look for bcdedit /set {default} recoveryenabled no, wbadmin delete catalog -quiet and wevtutil cl Application.
• Check Defender history for SilverBasket, MSBuildInlineTaskLoader.C and SuspClfsAccess, and DNS logs for aaaaabbbbbbb.eastus.cloudapp.azure[.]com.
• For the Play activity, look in user Music folders for paloaltoconfig.exe, paloaltoconfig.dll, 1day.exe, go.exe and cmdpostfix.bat, and match Symantec's hashes.

Timeline#

• Apr 8, 2025 — Microsoft fixes the bug, marks it exploited and publishes its Storm-2460 analysis. CISA adds it to KEV.
• Apr 9, 2025 — The Windows 10 1507 update (KB5055547) becomes available.
• Apr 29, 2025 — CISA's remediation deadline for federal agencies.
• May 7, 2025 — Symantec reports pre-patch use by the Play ransomware group.
• Oct 14, 2025 — Windows 10 reaches end of support.

Vulnerability records

• CVE-2025-29824 · KEV 2025-04-08 · Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-29824 Windows Common Log File System Driver Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — April 2025 Security Updates (CVRF data with KB numbers and acknowledgments) api.msrc.microsoft.com
3. Microsoft Threat Intelligence — Exploitation of CLFS zero-day leads to ransomware activity microsoft.com
4. CVE record — CVE-2025-29824 cve.org
5. NVD — CVE-2025-29824 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2025-29824 cisa.gov
7. Symantec Threat Hunter Team — Play ransomware group used Windows zero-day security.com
8. Tenable — Microsoft's May 2025 Patch Tuesday Addresses 71 CVEs (CLFS history incl. CVE-2024-49138) tenable.com
9. Microsoft Support — Windows 10 support has ended on October 14, 2025 support.microsoft.com