Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2025-32709 is an elevation of privilege vulnerability in Windows Ancillary Function Driver for WinSock (rated Important, CVSS 7.8). Microsoft reports that it is being exploited.
Exploited1 version
Facts
- Microsoft id
CVE-2025-32709- Status
- Exploited
- Products
- Windows Ancillary Function Driver for WinSock
- Severity
- Important
- Impact
- Elevation of Privilege
- CVSS
- 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
- Customer action required
- Yes
- Release
- 2025-May
- Assigned by
- Microsoft
- Weakness
- CWE-416: Use After Free
- MSRC revision
- 2.0
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-05-13:
Information published.
- Revision 2.0, 2025-05-15:
In the Security Updates table, added all supported editions of Windows Server 2008 and Windows Server 2008 R2 as they are affected by this vulnerability.
Microsoft says
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
As first seen: Exploited
- Status
- Exploited
Seen by us · Microsoft's timestamp · Microsoft's page