BI.ZONE researchers conducted a detailed analysis of CVE-2025-29824 in the Windows clfs.sys driver, the Common Log File System driver bug that lets attackers escalate privileges. CVE-2025-29824 is a use-after-free with a CVSS score of 7.8, exploitable by a local user with low privileges. It was no lab curiosity: Microsoft patched it on April 8, 2025 after Storm-2460 exploited it as a zero-day, using the PipeMagic backdoor to deploy ransomware against a small number of targets in the United States, Venezuela, Spain and Saudi Arabia. Windows 11 24H2 was not affected by the observed exploitation, because the exploit could not obtain the SeDebugPrivilege now required for certain system information classes. Security teams should review the complete research for exploitation mechanisms and mitigation strategies.
