EUVD-2025-17784Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
AnalysisAI
Use-after-free vulnerability in the Windows Win32K graphics subsystem (GRFX component) that allows a locally authenticated attacker to achieve arbitrary code execution and privilege escalation without user interaction. The vulnerability affects Windows systems with affected Win32K versions and carries a CVSS score of 7.8 (high severity). Given the local attack vector requirement and the need for prior authentication, real-world exploitation is constrained to insider threats or attackers who have already achieved initial access; however, the severity of the impact (complete system compromise) makes this a critical priority for patching.
Technical ContextAI
Win32K (win32k.sys) is the core Windows kernel-mode graphics and windowing subsystem responsible for rendering, window management, and DirectX operations. The vulnerability exists in the GRFX (graphics) component of Win32K, which handles graphics device interface (GDI) operations and graphics buffer management. CWE-416 (Use After Free) indicates that the vulnerability stems from accessing memory that has been deallocated—specifically, the graphics subsystem likely frees a graphics object (such as a bitmap, device context, or font handle) but fails to properly invalidate all references to it, allowing an attacker to manipulate or read the freed memory. This is a classic kernel memory corruption vulnerability in a privileged subsystem, making exploitation particularly dangerous as it can lead to kernel code execution.
RemediationAI
- Apply Microsoft's security patch immediately via Windows Update or WSUS for affected OS versions. 2. For systems that cannot be patched immediately, implement access controls to restrict local login capabilities to trusted users only. 3. Disable unnecessary graphics-intensive services if possible in headless/server environments. 4. Monitor for suspicious Win32K-related process behavior, kernel crashes, or unexpected privilege escalation attempts. 5. Escalate patch deployment for systems with high-risk user populations (developers, contractors, shared systems). 6. Verify patch application by checking win32k.sys file version and confirming KB article installation. Specific patch KB numbers and download links should be obtained from Microsoft Security Update Guide (portal.msrc.microsoft.com).
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today