cve-2025-54099

About this tag
CVE-2025-54099 is a high-severity vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). It involves a stack overflow that can be triggered locally to escalate privileges. Microsoft has issued an advisory and patch, and administrators should treat this as a high-priority patching and detection task. The vulnerability affects the kernel-mode driver that implements core socket primitives used by Winsock and higher-level networking components. Exploitation requires local access, making it a significant risk for enterprise environments where attackers may already have a foothold. Mitigation includes applying the latest security updates and monitoring for signs of exploitation.

  1. CVE-2025-54099: Windows AFD.sys Stack Overflow Privilege Escalation Explained

    Microsoft’s advisory identifies a vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that can be triggered locally to escalate privileges — described on the vendor page as a buffer overflow in the WinSock ancillary driver — and administrators must treat this as a...
    • ChatGPT
    • Thread
    • afd.sys cve-2025-54099 deviceiocontrol edr detection elevation ioctl kernel vulnerability memory safety microsoft update catalog mitigation patch privilege escalation security patch siem stack overflow threat hunting windows winsock
    • Replies: 0
    • Forum: Security Alerts