Skip to content
OpenAdvisories
High 1 exploited CVE MSRC-CVE-2025-32709 1 CVE

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Published May 13, 2025 · Updated May 15, 2025 · Revision 2

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.

I am running Windows Server 2008 or Windows Server 2008 R2. How do I protect my system from this vulnerability?
The protections for this vulnerability are not included in the following May 2025 monthly rollup or security-only updates released on May 13, 2025:
Windows Server 2008 R2: KB5058454 (Security-only update), Windows Server 2008 R2: KB5058430 (Monthly Rollup), Windows Server 2008: KB5058429 (Security-only update), Windows Server 2008: KB5058449 (Monthly Rollup)
Instead, customers running these versions of Windows Server need to install the following Out-of-Band (OOB) updates, released also on May 13, 2025, as applicable:
Windows Server 2008 R2: KB5061195 (Security-only update), Windows Server 2008 R2: KB5061196 (Monthly Rollup), Windows Server 2008: KB5061197 (Security-only update), Windows Server 2008: KB5061198 (Monthly Rollup)

Security updates
10.0.17763.7314 — https://support.microsoft.com/help/5058392
10.0.20348.3692 — https://support.microsoft.com/help/5058385
10.0.20348.3630 — https://support.microsoft.com/help/5058500
10.0.19044.5854 — https://support.microsoft.com/help/5058379
10.0.22621.5335 — https://support.microsoft.com/help/5058405
10.0.26100.4061 — https://support.microsoft.com/help/5058411
10.0.26100.3981 — https://support.microsoft.com/help/5058497
10.0.25398.1611 — https://support.microsoft.com/help/5058384
10.0.10240.21014 — https://support.microsoft.com/help/5058387
10.0.14393.8066 — https://support.microsoft.com/help/5058383
6.0.6003.23317 — https://support.microsoft.com/help/5061198
6.0.6003.23317 — https://support.microsoft.com/help/5061197
6.1.7601.27730 — https://support.microsoft.com/help/5061196
6.2.9200.25475 — https://support.microsoft.com/help/5058451
6.3.9600.22577 — https://support.microsoft.com/help/5058403

Vulnerabilities 1

Revision history

  1. #2

    In the Security Updates table, added all supported editions of Windows Server 2008 and Windows Server 2008 R2 as they are affected by this vulnerability. Customers running these versions of Windows Server please note that to be protected from this vulnerability you need to install the out-of-band updates as follows: * Windows Server 2008 R2: KB5061195 (Security-only update) * Windows Server 2008 R2: KB5061196 (Monthly Rollup) * Windows Server 2008: KB5061197 (Security-only update) * Windows Server 2008: KB5061198 (Monthly Rollup) Please see the Security Updates table and FAQs section for more information.

  2. #1

    Information published.

References