Use-After-Free Vulnerabilities
Three of the five zero-days involve use-after-free programming flaws—dangerous memory errors that can allow attackers to gain elevated privileges.
CVE-2025-30400: Affects the Desktop Window Manager (DWM) Core Library. This flaw allows a locally authorized user to escalate privileges on a compromised system.
CVE-2025-32701: Targets the Common Log File System (CLFS) Driver, enabling similar privilege escalation.
CVE-2025-32709: Impacts the Ancillary Function Driver for WinSock, also providing attackers a pathway to administrative control.
While no ransomware campaigns have been directly tied to these exploits yet, CISA emphasizes that the risk is substantial due to their active use in the wild.
Scripting Engine Type Confusion Vulnerability
CVE-2025-30397 is a critical flaw in the Microsoft Windows Scripting Engine caused by a type confusion error (CWE-843). This vulnerability allows remote code execution without the need for user privileges.
An attacker could exploit this by tricking a user into clicking on a malicious link. Successful attacks could allow the installation of malware, data theft, or broader system compromise.
This vulnerability is especially dangerous for organizations using browser-based or script-heavy applications, making it a prime target for phishing and drive-by download attacks.
Heap-Based Buffer Overflow in CLFS Driver
The final zero-day, CVE-2025-32706, involves a heap-based buffer overflow in the CLFS driver (CWE-122). This flaw can allow attackers to execute code or crash systems by sending specially crafted input data.
Due to the CLFS driver’s role in system operations and logging, a successful exploit could hinder detection and allow deeper compromise of network environments.
Urgent Mitigation Steps
CISA strongly advises organizations to take the following steps immediately:
- Apply all vendor patches and mitigations as released by Microsoft and related suppliers.
- Follow guidance from Binding Operational Directive 22-01 for cloud and critical service environments.
- Consider disabling or replacing affected systems if no patch is available.
With active exploitation confirmed, and the potential for ransomware or broader attacks high, organizations are urged to monitor the KEV catalog and reinforce their vulnerability management practices.
