Critical 0-Day in Windows Common Log File System Actively Exploited

Microsoft has released critical security updates to address a zero-day vulnerability in the Windows Common Log File System (CLFS) driver that has been actively exploited by ransomware operators.

The vulnerability, tracked as CVE-2025-29824, was disclosed as part of the April 2025 Patch Tuesday update that addressed over 120 vulnerabilities across Microsoft products.

Technical Details

The vulnerability is a use-after-free (CWE-416) flaw in the Windows CLFS driver that allows attackers to elevate their privileges to SYSTEM level on compromised Windows systems.

Microsoft has assigned it a CVSSv3 score of 7.8, rating it as “Important” with exploitation assessed as “Detected”.

Security researchers note that CLFS vulnerabilities have become increasingly popular targets for attackers.

Since 2022, Microsoft has patched 32 CLFS vulnerabilities, averaging 10 each year, with six exploited in the wild.

How the Exploit Works

Microsoft Threat Intelligence Center (MSTIC) discovered that threat actors deployed the exploit through PipeMagic malware.

The exploitation chain begins with attackers using certutil to download malicious MSBuild files from compromised legitimate websites.

Upon successful exploitation, the payload is injected into winlogon.exe, which then injects Sysinternals’ procdump.exe into dllhost.exe to dump LSASS memory and steal credentials.

The post-exploitation activity leads to ransomware deployment, with files being encrypted with random extensions and a ransom note named “!READ_ME_REXX2!.txt” being dropped on victims’ systems.

Impact and Affected Systems

The exploit has been observed against targets in multiple sectors, including information technology and real estate in the United States, financial institutions in Venezuela, a Spanish software company, and retail businesses in Saudi Arabia.

Most Windows Server and Windows versions are affected by this vulnerability.

However, Microsoft noted that “The security update for Windows 10 for x64-based systems and Windows 10 for 32-bit systems are not immediately available” but will be released as soon as possible.

Risk Factor Table

Recommendations

Microsoft highly recommends that organizations prioritize applying these security updates to add a layer of defense against ransomware attacks if threat actors gain an initial foothold.

Organizations using affected systems should:

• Apply the April 8, 2025, security updates immediately
• Monitor for suspicious activity related to CLFS
• Watch for processes interacting with clfs.sys, being spawned by it, or showing anomalous behavior

For organizations that cannot immediately apply patches, security teams should implement enhanced monitoring: “Security teams are advised to monitor the CLFS driver closely using EDR/XDR tools.

This includes watching for processes interacting with clfs.sys, being spawned by it, or showing anomalous behavior when communicating with other drivers or memory spaces,” advised Ben McCarthy, lead cybersecurity engineer at Immersive Labs.

Given the history of CLFS vulnerabilities being leveraged by ransomware operators, organizations should treat this patch with high priority to protect their systems from potential

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates