CVE-2025-24983: Microsoft Windows Win32k Use-After-Free Vulnerability

High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2025-03-11. EPSS: 1.4% chance of exploitation in the next 30 days.

Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Windows 10 1507: before 10.0.10240.20947 (fixed in 10.0.10240.20947)
• Microsoft Windows 10 1607: before 10.0.14393.7876 (fixed in 10.0.14393.7876)
• Microsoft Windows Server 2008: affected versions not specified; version r2 only
• Microsoft Windows Server 2012: affected versions not specified; version r2 only
• Microsoft Windows Server 2016: before 10.0.14393.7876 (fixed in 10.0.14393.7876)

Published 2025-03-11. Last modified 2026-06-17.