CVE-2025-24993KEV · OVERDUECWE-122

Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

High · published March 11, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 82.5th percentile for exploit probability.

571
days past CISA
deadline
CVSS v3.1
7.8
EPSS
2%
Percentile
82.5
In the wild
Confirmed
What it is

🚨 An unauthorized attacker could exploit this heap-based buffer overflow in Windows NTFS to run code locally — think of it as a thief bypassing the security system to make themselves at home! 🔥 Imagine a mailroom where anyone can walk in and change the delivery instructions without being questioned. That's what this vulnerability allows: an attacker can manipulate data in a way that makes the system execute their commands without proper checks in place. If exploited, an attacker could take complete control of affected systems, running malicious code as if they were a trusted user. This could lead to data breaches, unauthorized access to sensitive information, and even the complete takeover of the machine—absolutely devastating! ⚡

Put simply

Imagine a mailroom where anyone can walk in and change the delivery instructions without being questioned. That's what this vulnerability allows: an attacker can manipulate data in a way that makes the system execute their commands without proper checks in place. This vulnerability involves a heap-based buffer overflow in Windows NTFS, enabling unauthorized users to execute arbitrary code locally when manipulating data structures incorrectly. It's like a hidden trapdoor in the system!

What to do

If exploited, an attacker could take complete control of affected systems, running malicious code as if they were a trusted user. This could lead to data breaches, unauthorized access to sensitive information, and even the complete takeover of the machine—absolutely devastating! ⚡ To safeguard your systems, ensure you immediately apply the security patches provided by Microsoft for this vulnerability. Additionally, review and restrict user access to sensitive areas of the file system to minimize exposure. You've got this! Follow these steps to secure your systems and protect against this risk. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02216 · 82.5th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2025-03-11T21:16Z
KEV added
2025-03-11 · due 2025-04-01
Affected products (28)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.2094710.0.10240.20947
microsoft/windows_10_1507< 10.0.10240.2094710.0.10240.20947
microsoft/windows_10_1607< 10.0.14393.787610.0.14393.7876
microsoft/windows_10_1607< 10.0.14393.787610.0.14393.7876
microsoft/windows_10_1809< 10.0.17763.700910.0.17763.7009
microsoft/windows_10_1809< 10.0.17763.700910.0.17763.7009
microsoft/windows_10_21h2< 10.0.19044.560810.0.19044.5608
microsoft/windows_10_21h2< 10.0.19044.560810.0.19044.5608
microsoft/windows_10_21h2< 10.0.19044.560810.0.19044.5608
microsoft/windows_10_22h2< 10.0.19045.560810.0.19045.5608
microsoft/windows_10_22h2< 10.0.19045.560810.0.19045.5608
microsoft/windows_10_22h2< 10.0.19045.560810.0.19045.5608
microsoft/windows_11_22h2< 10.0.22621.503910.0.22621.5039
microsoft/windows_11_22h2< 10.0.22621.503910.0.22621.5039
microsoft/windows_11_23h2< 10.0.22631.503910.0.22631.5039
microsoft/windows_11_23h2< 10.0.22631.503910.0.22631.5039
microsoft/windows_11_24h2< 10.0.26100.340310.0.26100.3403
microsoft/windows_11_24h2< 10.0.26100.340310.0.26100.3403
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.787610.0.14393.7876
microsoft/windows_server_2019< 10.0.17763.700910.0.17763.7009
microsoft/windows_server_2022< 10.0.20348.327010.0.20348.3270
microsoft/windows_server_2022_23h2< 10.0.25398.148610.0.25398.1486
microsoft/windows_server_2025< 10.0.26100.340310.0.26100.3403
References (2)
EPSS history
Timeline
  • 11 MAR 16:59Z
    Windows NTFS Remote Code Execution Vulnerability
    cvelistv5
  • 11 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 1
    kev