erroneo.us
Search all guides⌘K

Security Digest · May 13, 2025 · Vulnerability · OS / kernel

Windows May 2025: Five Zero-Days in CLFS, AFD, DWM

May 13, 2025 updates fixed five exploited Windows bugs: four SYSTEM-level EoPs and an IE-mode scripting RCE. Confirm builds; IE mode raises the stakes.

Published By erroneo.us Security Desk · Updated 3 min read14 sources

Our verdict

Check exposure

All five were exploited before the May 2025 fix, but every later cumulative update covers them; confirm no host is stuck below the May 2025 builds, that Server 2008 boxes got the separate AFD update, and that IE mode is enabled only where needed.

Who must act: Admins of Windows hosts below the May 2025 builds, of Server 2008 and 2008 R2 systems that never got the out-of-band AFD fix, and of fleets that keep Edge IE mode switched on.

Who can relax: Fleets that have installed monthly cumulative updates since May 2025, including the August 2026 AFD fix, are covered and need only confirm it.

Affected
Windows 10 1507, 1607, 1809, 21H2, 22H2 before builds 10240.21014 / 14393.8066 / 17763.7314 / 19044.5854 / 19045.5854
Windows 11 22H2 / 23H2 before 22621.5335 / 22631.5335; Windows 11 24H2 before 26100.4061
Windows Server 2016 / 2019 / 2022 before 14393.8066 / 17763.7314 / 20348.3692; Server 2025 before 26100.4061
Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2 before the May 2025 updates (DWM bug: Windows 10 1809 and later, Server 2019 and later only)
Fixed in
May 13, 2025 cumulative updates, e.g. KB5058411 (Windows 11 24H2 / Server 2025), KB5058405 (Windows 11 23H2), KB5058379 (Windows 10 22H2)
KB5058385 (Server 2022), KB5058392 (Server 2019), KB5058383 (Server 2016), KB5058403 (Server 2012 R2)
Server 2008 / 2008 R2 AFD fix only in out-of-band KB5061195 / KB5061196 / KB5061197 / KB5061198
Any later cumulative update
CVSS
7.8 (v3.1, vendor)
EPSS
27.3% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Confirm every Windows host runs the May 13, 2025 cumulative update or later by comparing build and revision with the fixed builds.
  2. On Windows Server 2008 and 2008 R2, check for the out-of-band updates KB5061195-KB5061198; the regular May rollups did not fix the AFD bug.
  3. Find where Edge Internet Explorer mode is enabled and turn it off except for named legacy sites.
  4. Go past May 2025: AFD had another exploited zero-day, CVE-2026-68820, fixed in August 2026.
  5. Retire or isolate Windows 10 machines without Extended Security Updates and out-of-support servers.

How to check if you are affected or compromised

  • Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, and compare with the fixed builds.
  • On Server 2008 / 2008 R2, run Get-HotFix -Id KB5061195,KB5061196,KB5061197,KB5061198 to confirm the AFD fix.
  • Hunt for processes started by a normal user that suddenly run as SYSTEM, and for unexpected .blf files written by user processes.
  • Review Edge policy reports for the InternetExplorerIntegrationLevel setting to see where IE mode is active.

What happened#

On May 13, 2025, Microsoft's Patch Tuesday fixed five Windows bugs that attackers were already using. CISA added all five to the KEV catalog that day, with a June 3 deadline. Four let a user who already runs code on a machine reach SYSTEM or administrator. The fifth is a remote code execution bug that needs a click. None was publicly disclosed before the fix.

  • CVE-2025-32706: CLFS driver, CVSS 7.8. Microsoft's advisory calls it a heap-based buffer overflow; the CVE record says improper input validation. Credited to Benoit Sevens of Google Threat Intelligence Group and the CrowdStrike Advanced Research Team.
  • CVE-2025-32701: CLFS driver use-after-free, CVSS 7.8, found by the Microsoft Threat Intelligence Center (MSTIC).
  • CVE-2025-30400: Desktop Window Manager (DWM) Core Library use-after-free, CVSS 7.8, found by MSTIC.
  • CVE-2025-32709: Ancillary Function Driver for WinSock (afd.sys), CVSS 7.8, reported anonymously. KEV lists it as a use-after-free; the current CVE record says null pointer dereference. Microsoft says it grants administrator rights.
  • CVE-2025-30397: Scripting Engine type confusion, CVSS 7.5, found by MSTIC. The target must use Microsoft Edge in Internet Explorer mode and click a crafted link.

Microsoft did not say who used these bugs or how, as BleepingComputer noted. As of Oct 23, 2026, no attribution or technical write-up for these five campaigns has been disclosed. CISA lists ransomware use as unknown for all of them. Tenable called CLFS "a popular attack vector" that ransomware gangs have exploited. The two May bugs followed the exploited CLFS zero-days CVE-2024-49138 in December 2024 and CVE-2025-29824 in April 2025. Tenable also counted CVE-2025-30400 as the seventh DWM privilege escalation bug fixed in 2025.

Who is affected#

The CLFS, AFD and scripting bugs affect every Windows version then supported, from Windows 10 1507 and Server 2008 through Windows 11 24H2 and Server 2025. The DWM bug affects only Windows 10 1809 and later, Windows 11 and Server 2019 and later, per its CVE record. Fixed builds include 19045.5854 for Windows 10 22H2, 22631.5335 for Windows 11 23H2, 26100.4061 for Windows 11 24H2 and Server 2025, and 20348.3692 for Server 2022. The May CVRF data lists the KB numbers.

One trap: on May 15, Microsoft added Server 2008 and 2008 R2 to the AFD advisory. The normal May rollups for those systems do not fix it. Only the out-of-band updates KB5061195, KB5061196, KB5061197 and KB5061198 do.

Do you really need to act?#

Mostly no new work. Cumulative updates carry earlier fixes, so any client or modern server patched since May 2025 is covered. Look at three gaps. First, machines that stopped patching, including Windows 10 devices without Extended Security Updates after October 14, 2025. Second, old Server 2008 boxes that got the May rollup but not the out-of-band AFD update. Third, IE mode. It is the only path to the scripting bug, and it keeps a legacy engine reachable from the web.

Being current for May 2025 is not the end of it. AFD had another exploited zero-day, CVE-2026-68820, used by Lazarus and fixed in August 2026. CLFS keeps returning too. The fix for all of these is the same: stay on the latest cumulative update.

What to do now#

  1. Check builds with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and install the current cumulative update on anything behind.
  2. On Server 2008 and 2008 R2, run Get-HotFix -Id KB5061195,KB5061196,KB5061197,KB5061198. If none is present, install the matching one if your support agreement provides it. Otherwise plan to replace the server.
  3. Audit the Edge policy InternetExplorerIntegrationLevel and limit IE mode to a named site list, or turn it off.
  4. Retire or isolate machines that no longer receive security updates.

How to tell if you were hit#

Microsoft published no indicators for these five bugs, so hunting is behavioral. Look in EDR for processes started by a normal user that later run as SYSTEM, for credential dumping of lsass.exe on workstations, and for .blf log files written by unusual processes in user-writable folders. Look for Edge in IE mode loading pages outside your legacy site list. If you find a compromised host from mid-2025, rebuild it and rotate its credentials. A local privilege escalation is rarely the first or last step of an attack.

Timeline#

  • — Microsoft fixes all five bugs and marks them exploited. CISA adds them to KEV.
  • — Microsoft adds Server 2008 and 2008 R2 to the AFD advisory and points to out-of-band updates.
  • — CISA's remediation deadline for federal agencies.
  • — Windows 10 reaches end of support.
  • — Microsoft fixes CVE-2026-68820, a newer exploited AFD bug.

Vulnerability records

  • CVE-2025-32709 · KEV 2025-05-13 · Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
  • CVE-2025-30397 · KEV 2025-05-13 · Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
  • CVE-2025-32706 · KEV 2025-05-13 · Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
  • CVE-2025-32701 · KEV 2025-05-13 · Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
  • CVE-2025-30400 · KEV 2025-05-13 · Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Microsoft MSRC — CVE-2025-32709 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability msrc.microsoft.com
  2. Microsoft MSRC — CVE-2025-30397 Scripting Engine Memory Corruption Vulnerability msrc.microsoft.com
  3. Microsoft MSRC — CVE-2025-32706 Windows Common Log File System Driver Elevation of Privilege Vulnerability msrc.microsoft.com
  4. Microsoft MSRC — CVE-2025-32701 Windows Common Log File System Driver Elevation of Privilege Vulnerability msrc.microsoft.com
  5. Microsoft MSRC — CVE-2025-30400 Microsoft DWM Core Library Elevation of Privilege Vulnerability msrc.microsoft.com
  6. Microsoft MSRC — May 2025 Security Updates (CVRF data with KB numbers and acknowledgments) api.msrc.microsoft.com
  7. CVE record — CVE-2025-32709 cve.org
  8. CVE record — CVE-2025-30400 cve.org
  9. NVD — CVE-2025-32706 nvd.nist.gov
  10. CISA — Known Exploited Vulnerabilities: CVE-2025-32709 cisa.gov
  11. CISA — Known Exploited Vulnerabilities: CVE-2025-30397 cisa.gov
  12. Tenable — Microsoft's May 2025 Patch Tuesday Addresses 71 CVEs (CVE-2025-32701, CVE-2025-32706) tenable.com
  13. Microsoft Support — Windows 10 support has ended on October 14, 2025 support.microsoft.com

Coverage and analysis

  1. BleepingComputer — Microsoft May 2025 Patch Tuesday fixes 5 exploited zero-days, 72 flaws bleepingcomputer.com