CVE-2025-32709: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft windows server 2008all versions
• microsoft windows server 2008r2
• microsoft windows server 2012all versions
• microsoft windows server 2012r2
• microsoft windows server 2016before 10.0.14393.8066
• microsoft windows server 2019before 10.0.17763.7314
• microsoft windows server 2022before 10.0.20348.3692
• microsoft windows server 2022 23h2before 10.0.25398.1611
• microsoft windows server 2025before 10.0.26100.3981

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Windows 10 Version 1507

  • 10.0.10240.0 and later · before 10.0.10240.21014affected

• Microsoft Windows 10 Version 1607

  • 10.0.14393.0 and later · before 10.0.14393.8066affected

• Microsoft Windows 10 Version 1809

  • 10.0.17763.0 and later · before 10.0.17763.7314affected

• Microsoft Windows 10 Version 21H2

  • 10.0.19044.0 and later · before 10.0.19044.5854affected

• Microsoft Windows 10 Version 22H2

  • 10.0.19045.0 and later · before 10.0.19045.5854affected

• Microsoft Windows 11 version 22H2

  • 10.0.22621.0 and later · before 10.0.22621.5335affected

• Microsoft Windows 11 version 22H3

  • 10.0.22631.0 and later · before 10.0.22631.5335affected

• Microsoft Windows 11 Version 23H2

  • 10.0.22631.0 and later · before 10.0.22631.5335affected

• Microsoft Windows 11 Version 24H2

  • 10.0.26100.0 and later · before 10.0.26100.4061affected

• Microsoft Windows Server 2008 R2 Service Pack 1

  • 6.1.7601.0 and later · before 6.1.7601.27730affected

• Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)

  • 6.1.7601.0 and later · before 6.1.7601.27730affected

• Microsoft Windows Server 2008 Service Pack 2

  • 6.0.6003.0 and later · before 6.0.6003.23317affected

Other highest-scoring records for the same primary product.

• CVE-2021-34527Windows Print Spooler Remote Code Execution VulnerabilityKEV
  95Now
• CVE-2021-40444Microsoft MSHTML Remote Code Execution VulnerabilityKEV
  94Now
• CVE-2025-33053Internet Shortcut Files Remote Code Execution VulnerabilityKEV
  91Now

Published before and after this one in the same product

• ← EarlierCVE-2025-32706May 13, 2025 · Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV
  62This week
• ← EarlierCVE-2025-32707May 13, 2025 · NTFS Elevation of Privilege Vulnerability
  31Monitor
• Later →CVE-2025-24065Jun 10, 2025 · Windows Storage Management Provider Information Disclosure Vulnerability
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.