CVE-2025-29824

Name of the Vulnerable Software and Affected Versions Microsoft Windows Common Log File System (CLFS) Driver (affected versions not specified)

Description An issue exists in the Windows Common Log File System (CLFS) driver where memory is used after it has been freed. This flaw allows an authorized local attacker to elevate their privileges to the SYSTEM level. The issue is caused by a race condition between the IRP MJ CLEANUP and IRP MJ CLOSE handlers, involving the FsContext2 pointer.

Real-world exploitation has been observed by ransomware operators, including the RansomEXX group and actors associated with the Storm-2460 group. In these attacks, a modular memory-resident backdoor called PipeMagic was deployed. The execution chain involved using certutil to download a payload and MSBuild to decrypt and execute it in memory. Attackers utilized the NtQuerySystemInformation function to obtain kernel addresses and the RtlSetAllBits function within the kernel to enable all process privileges by corrupting the EPROCESS structure. To interact with the vulnerable clfs.sys driver, attackers created a specific file at C:ProgramDataSkyPdfPDUDrv.blf. Following privilege escalation, the payload was injected into winlogon.exe, procdump.exe, and dllhost.exe to steal credentials from the LSASS process memory and encrypt files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.