DaystoPatch

MicrosoftExploited incident

Windows CLFS zero-day used by ransomware actor; Windows 10 fix a day after Patch Tuesday (CVE-2025-29824)

CVE-2025-29824High, CVSS 7.8In CISA's Known Exploited Vulnerabilities catalog since 8 Apr 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 1 day after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
1d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE-2025-29824 record (CNA: Microsoft)CuratedQuote verified

    "datePublished":"2025-04-08T17:23:34.083Z"

    Disclosed on April 2025 Patch Tuesday as exploited in the wild (found by Microsoft); no earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d5bfc672b381863d…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Microsoft advisory CVE-2025-29824ClaimedQuote not found in archive8 Apr 2025

    Windows Common Log File System Driver Elevation of Privilege Vulnerability. Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    The vendor's own disclosure.

    Source
    Microsoft advisory CVE-2025-29824 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:d1f007e75894bd92…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-29824)ClaimedQuote verified8 Apr 2025

    Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability

    Added to CISA's KEV catalog on 2025-04-08.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-29824ClaimedQuote verified8 Apr 2025, 17:23 UTC

    Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d5bfc672b381863d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet8 Apr 2025, 17:45 UTC

    CVE-2025-29824

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet8 Apr 2025, 19:15 UTC

    Windows has a hidden trapdoor—CVE-2025-29824—that's letting ransomware gangs grab SYSTEM-level control with ease. Could your system be next? Read how to safeguard your data from this zero-day threat. https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE-2025-29824 record (CNA: Microsoft)CuratedQuote verified

    "datePublished":"2025-04-08T17:23:34.083Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d5bfc672b381863d…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Microsoft advisory CVE-2025-29824ClaimedQuote not found in archive8 Apr 2025

    Windows Common Log File System Driver Elevation of Privilege Vulnerability. Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

    Source
    Microsoft advisory CVE-2025-29824 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Not found in the archived copy. Treat with caution.
    Snapshot
    sha256:d1f007e75894bd92…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Microsoft Threat Intelligence: Exploitation of CLFS zero-day leads to ransomware activityCuratedQuote verified

    and was fixed on April 8, 2025.

    Sentence: 'The vulnerability is tracked as CVE-2025-29824 and was fixed on April 8, 2025.' (re-quoted 2026-10-23 so the quote does not cross the CVE link markup).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:dbcca06627b8ddd3…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Microsoft advisory CVE-2025-29824ClaimedQuote verified8 Apr 2025

    Information published.

    Vendor Fix listed at the first revision

    Source
    Microsoft advisory CVE-2025-29824 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6365e70c817b559b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+1d

    MSRC CVRF document 2025-Apr (CVE-2025-29824 entry)CuratedQuote verified

    The security updates for Windows 10 for 32-bit Systems and Windows 10 for x64-based Systems are now available.

    CVRF revision 2.0, dated 2025-04-09. Windows 10 32-bit and x64 updates were missing from the Patch Tuesday release on 2025-04-08.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6365e70c817b559b…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Microsoft advisory CVE-2025-29824ClaimedQuote verified8 Apr 2025

    Information published.

    every Known Affected product has a Vendor Fix and no later revision announces more updates

    Source
    Microsoft advisory CVE-2025-29824 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6365e70c817b559b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Windows Common Log File System driver on supported Windows client and server versions (Windows 10 32-bit and x64 fixed one day later)
How we built this timeline

Selected as a patch-day exception because the fix was staggered: most Windows versions were fixed on 8 Apr 2025 but Windows 10 32-bit and x64 got their updates a day later (CVRF revision 2.0, 9 Apr 2025). Zero-day: Microsoft found it exploited by Storm-2460 deploying PipeMagic and ransomware against a small number of targets.

Microsoft's CVRF timestamps here are T00:00:00 dates, so day precision. CVSS 7.8 from Microsoft. ransomware=true follows KEV ('Known').

Related

Microsoft report card