CVE-2025-27096: Windows WFP Kernel Double-Free Exploit Analysis

In March 2025, Microsoft patched CVE-2025-27096, a critical elevation-of-privilege vulnerability in the Windows Filtering Platform (WFP) kernel driver. The flaw, a double-free in the WFP callout management subsystem, was reported by researchers at DBAPPSecurity and quickly added to CISA's Known Exploited Vulnerabilities catalog. This article dissects the technical mechanics of the double-free, maps out affected builds, and provides concrete detection and mitigation strategies. After reading, you'll be able to assess your exposure, write detection rules, and apply the official patches.

Background: The Windows Filtering Platform and the Double-Free

The Windows Filtering Platform (WFP) is a kernel-level API that enables network filtering, traffic inspection, and connection control. It underpins Windows Defender Firewall, IPsec, and many third-party security products. WFP operates through a layered architecture: kernel-mode callout drivers register callouts that are invoked during packet processing. These callouts are managed by the WFP engine, which maintains state about registered filters and callouts.

CVE-2025-27096 is a double-free vulnerability located in the WFP callout management code, specifically within the WfpCalloutDelete and related functions. A double-free occurs when the same memory region is released twice, corrupting the kernel heap. An authenticated attacker who can create and delete WFP callouts could trigger this flaw to execute arbitrary code with SYSTEM privileges.

The vulnerability was assigned a CVSS v3.1 score of 7.8 (High) by Microsoft, indicating serious impact but requiring local access. Microsoft's advisory (linked in Sources) confirms that exploitation could allow an attacker to gain SYSTEM privileges, and the vulnerability has been added to CISA's KEV catalog, meaning it has been exploited in the wild.

\"CVE-2025-27096 is a Windows Filtering Platform elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.\" — Microsoft Security Response Center advisory

Affected Versions and Patch Availability

Microsoft's security advisory for CVE-2025-27096, published on March 11, 2025, lists all supported versions of Windows 10, Windows 11, and Windows Server 2016 through 2022 as affected. The vulnerability was patched in the March 2025 Patch Tuesday update. Specific affected builds include Windows 10 21H2, 22H2, Windows 11 21H2, 22H2, 23H2, and 24H2, as well as Windows Server 2016, 2019, 2022.

Administrators should apply the March 2025 cumulative updates immediately. The update IDs are available in the Microsoft Security Response Center (MSRC) advisory linked in Sources. For systems that cannot be patched immediately, Microsoft recommends restricting access to WFP APIs and monitoring for unusual callout activity.

Attacker TTPs and MITRE ATT&CK Mapping

Exploitation of CVE-2025-27096 follows a classic local privilege escalation pattern. An attacker first gains initial access to a Windows system through any means (e.g., phishing, exploiting a remote vulnerability). They then leverage the WFP double-free to escalate privileges to SYSTEM. This aligns with MITRE ATT&CK techniques:

• Exploitation for Privilege Escalation (T1068) — The primary technique, as the attacker exploits the kernel vulnerability to gain higher privileges.
• Windows Management Instrumentation (T1047) — Attackers may use WMI to interact with WFP and trigger the vulnerable code path remotely or via scripts.
• PowerShell (T1059.001) — Many exploit PoCs are delivered via PowerShell scripts that load a DLL to call WFP APIs.

The actual exploitation involves calling the FwpsCalloutDelete and FwpsCalloutRegister functions in a specific sequence to cause a double-free in the kernel. Public exploit code (e.g., on GitHub) demonstrates this, but we do not link to it here due to policy.

Detection: Sigma and YARA Rules

Detecting exploitation of CVE-2025-27096 is challenging because the vulnerability is in kernel mode and does not produce typical network signatures. However, SOC teams can monitor for suspicious WFP activity using Event Logs and ETW. The following Sigma rule detects abnormal callout registration and deletion patterns:

title: Suspicious WFP Callout Activity
id: 7b8f3d2e-5c4a-4f6b-9e2d-1a2b3c4d5e6f
status: experimental
description: Detects excessive WFP callout registration/deletion events that may indicate exploitation of CVE-2025-27096
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5156  # Windows Filtering Platform has allowed a connection
    Callout: 'Microsoft-Windows-Filtering-Platform'
  condition: selection | count() by Computer > 100
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068

For file-based detection, a YARA rule can flag known exploit payloads that target WFP. Example YARA rule:

rule CVE_2025_27096_WFP_Exploit {
  meta:
    author = "CybernytronX"
    date = "2025-03-15"
    description = "Detects known exploit artifacts for CVE-2025-27096"
  strings:
    $s1 = "FwpsCalloutDelete" ascii wide
    $s2 = "FwpsCalloutRegister" ascii wide
    $s3 = "NtCreateFile" ascii wide
  condition:
    any of them and filesize < 2MB
}

Additionally, enabling WFP audit events via auditpol /set /subcategory:\"Filtering Platform Packet Drop\" /success:enable /failure:enable can provide visibility. SOC teams should also monitor for unusual kernel driver loads using Sysmon Event ID 6.

Mitigation and Remediation

The primary mitigation is to apply the March 2025 Patch Tuesday updates. Microsoft has released updates for all affected Windows versions. For systems that cannot be patched immediately, Microsoft recommends the following interim measures:

• Restrict access to WFP APIs by limiting who can load kernel drivers or interact with the WFP engine. Use AppLocker or WDAC to block unauthorized DLLs.
• Monitor for unusual callout activity using the detection rules above.
• Apply the principle of least privilege to reduce the attack surface.
• If third-party security products rely on WFP, ensure they are updated to versions compatible with the patch.

For detailed guidance, refer to the Microsoft Security Update Guide linked in Sources.

Why This Matters for Defenders

CVE-2025-27096 is a stark reminder that kernel-level vulnerabilities in foundational Windows components are prime targets for privilege escalation. The fact that it was exploited in the wild before the patch was released underscores the importance of rapid patch management. Defenders must treat WFP as a critical subsystem, not just a firewall backend. The double-free flaw demonstrates that even mature codebases can harbor subtle memory corruption bugs. By understanding the technical details and implementing the detection and mitigation strategies outlined above, security teams can significantly reduce their exposure. Stay vigilant, patch promptly, and monitor for indicators of compromise.

Sources

• Microsoft Security Update Guide - CVE-2025-27096 — Confirms affected versions, CVSS score, and patch availability.
• CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-27096 as actively exploited.
• NVD Entry for CVE-2025-27096 — Provides vulnerability description and technical details.

Frequently Asked Questions

What exactly is a double-free vulnerability?

A double-free occurs when a program attempts to free the same memory block twice. This corrupts the heap metadata, potentially allowing an attacker to overwrite arbitrary memory and execute code.

Is CVE-2025-27096 exploitable remotely?

No, it is a local privilege escalation vulnerability. An attacker must already have code execution on the target system to exploit it.

How can I tell if my systems are vulnerable?

Check if your Windows version is listed in the Microsoft advisory and whether the March 2025 cumulative update has been applied. Use the Windows Update history or the Get-HotFix PowerShell cmdlet to verify.

What is the CVSS score for CVE-2025-27096?

The CVSS v3.1 score is 7.8 (High), as stated in the Microsoft advisory.

Are there any public exploits available?

Yes, proof-of-concept code has been publicly released. This increases the risk of exploitation, so patching is urgent.

Can third-party security tools trigger this vulnerability?

Yes, any software that uses WFP callouts could inadvertently trigger the vulnerable code path. Ensure all security products are updated.

Need expert help with this?

Our team at CybernytronX specializes in kernel-level security assessments and can help you identify exposure to CVE-2025-27096 and similar threats. We offer penetration testing, SOC build-out, and our Ethereon AI threat detection platform provides real-time monitoring for exploit attempts. Contact us to schedule a security review, or learn more about Ethereon.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.