Is CVE-2025-30400 (Microsoft Windows DWM Core Library Use-After-Free) being exploited in the wild?

Yes. CISA added CVE-2025-30400 to its Known Exploited Vulnerabilities catalogue on 13 May 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Any organisation running the affected product should treat remediation as urgent.

What the CISA KEV listing tells you about active exploitation

CISA’s Known Exploited Vulnerabilities catalogue is not a theoretical watchlist. When a CVE appears there, the practical assumption is that real-world exploitation has been observed and defenders should act as if the weakness is already on attacker radar. For CISA Known Exploited Vulnerabilities Catalog entries, the key question shifts from “is this exploitable?” to “where is it exposed and how fast can we reduce the blast radius?”

For validation and record-keeping, pair the KEV listing with the canonical CVE record in the CVE Program and the product record in the NIST National Vulnerability Database. That gives you the authoritative identifiers, the vendor mapping, and the remediation trail without guessing from secondary reporting.

Why a Windows DWM Core Library use-after-free matters operationally

A use-after-free in the Windows DWM Core Library is dangerous because it affects a core local component that can be abused for privilege escalation. Even though the direct attack path is local and requires an authorized attacker, that still matters in a real environment: a foothold from phishing, malware, stolen credentials, or a prior low-privilege compromise can become a path to higher privileges.

For defenders, the practical issue is not just patch presence. It is whether endpoints are exposed to local post-compromise escalation, whether admin workstations are reachable from lower-trust processes, and whether an attacker could chain this with credential theft or persistence. That is why exploitation in the wild should be treated as an urgent remediation signal, not as a narrow desktop bug.

What to do when patching or fleet remediation is not immediate

Start by confirming exposure on all Windows systems that can run the affected component, then prioritize the hosts most likely to be reached after an initial compromise, especially user workstations, developer machines, and jump hosts. If you cannot remediate immediately, reduce the chance that a local foothold can turn into elevated access by tightening local admin rights, isolating high-value endpoints, and increasing monitoring on suspicious process chains and privilege changes.

Because this CVE is already in KEV, delay should be treated as an exception that needs a business reason, an owner, and a deadline. Where patching must wait, collect evidence now: inventory the affected systems, verify whether any of them already showed signs of suspicious logons or process injection, and review whether endpoint detection coverage is sufficient to catch privilege escalation attempts.

Risk and Threat Considerations

The main risk is post-compromise privilege escalation. A local use-after-free may not be the first foothold, but once an attacker lands on a host it can help convert limited access into a more powerful session, which raises the odds of persistence, lateral movement, and tampering with security tools.

Failure mechanism: An attacker with local execution triggers the memory corruption, leverages the resulting instability or control-flow weakness, and attempts to raise privileges on the same system before defenders notice the precursor compromise.

Impact: Successful exploitation can turn a low-privilege breach into a higher-value endpoint compromise, increasing the chance of credential access, defense evasion, and follow-on movement inside the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	KEV-listed local flaws require hardened Windows baselines and rapid exposure reduction.
Recommendation — Harden Windows endpoints and remove risky local privilege paths.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	An actively exploited Windows CVE requires prompt remediation tracking and exception handling.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation depends on identifying all affected systems and verifying remediation status.
	AU-2 — Event Logging	Privilege-escalation attempts and suspicious process chains need logging for compromise checks.
Recommendation — Track, prioritize, and remediate the vulnerable Windows component quickly. Continuously identify exposed hosts and validate remediation coverage. Log relevant host activity to support hunting for exploitation.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	The answer hinges on confirming which assets are exposed to the KEV-listed weakness.
Recommendation — Identify where the vulnerable Windows component exists across the fleet.

Practitioner Guidance

What to verify: Confirm that the vulnerable Windows estate is actually covered by your patch or mitigation plan, not just listed in an inventory. KEV status should drive an explicit check for exposed laptops, workstations, and servers that users can touch directly, because those are the systems most likely to be turned into escalation points.

Decision rule: If the host can be reached by an attacker after a first-stage compromise, prioritize remediation before routine maintenance work. If remediation is delayed, treat the endpoint as a higher-risk asset and raise logging, detection, and access scrutiny around it.

Practitioner takeaway: For an exploited-in-the-wild local privilege escalation, the right posture is urgent exposure removal plus compromise hunting, because KEV listing means the question is no longer whether attackers will try it, but where they already can.