7

CVE-2025-53134

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 HwPlatform x64 Version < 10.0.10240.21100
Microsoft ≫ Windows 10 1507 HwPlatform x86 Version < 10.0.10240.21100
Microsoft ≫ Windows 10 1607 HwPlatform x64 Version < 10.0.14393.8330
Microsoft ≫ Windows 10 1607 HwPlatform x86 Version < 10.0.14393.8330
Microsoft ≫ Windows 10 1809 HwPlatform x64 Version < 10.0.17763.7678
Microsoft ≫ Windows 10 1809 HwPlatform x86 Version < 10.0.17763.7678
Microsoft ≫ Windows 10 21h2 Version < 10.0.19044.6216
Microsoft ≫ Windows 10 22h2 Version < 10.0.19045.6216
Microsoft ≫ Windows 11 22h2 Version < 10.0.22621.5768
Microsoft ≫ Windows 11 23h2 Version < 10.0.22631.5768
Microsoft ≫ Windows 11 24h2 Version < 10.0.26100.4851
Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x86
Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.8330
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.7678
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.3989
Microsoft ≫ Windows Server 2022 23h2 Version < 10.0.25398.1791
Microsoft ≫ Windows Server 2025 Version < 10.0.26100.4851
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.232
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Microsoft 7 1 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53134
Vendor Advisory