CVE-2025-24084
Published: 11 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24084 is an untrusted pointer dereference vulnerability (CWE-822) in the Windows Subsystem for Linux (WSL). Published on 2025-03-11, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute arbitrary code locally within the affected WSL component.
A local attacker can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing full code execution in the context of WSL.
Microsoft's update guide provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24084.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Local untrusted pointer dereference enabling arbitrary code execution with no privileges or user interaction required directly maps to exploitation for privilege escalation.