High · published March 11, 2025
CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 82.5th percentile for exploit probability.
🚨 An unauthorized attacker could exploit this heap-based buffer overflow in Windows NTFS to run code locally — think of it as a thief bypassing the security system to make themselves at home! 🔥 Imagine a mailroom where anyone can walk in and change the delivery instructions without being questioned. That's what this vulnerability allows: an attacker can manipulate data in a way that makes the system execute their commands without proper checks in place. If exploited, an attacker could take complete control of affected systems, running malicious code as if they were a trusted user. This could lead to data breaches, unauthorized access to sensitive information, and even the complete takeover of the machine—absolutely devastating! ⚡
Imagine a mailroom where anyone can walk in and change the delivery instructions without being questioned. That's what this vulnerability allows: an attacker can manipulate data in a way that makes the system execute their commands without proper checks in place. This vulnerability involves a heap-based buffer overflow in Windows NTFS, enabling unauthorized users to execute arbitrary code locally when manipulating data structures incorrectly. It's like a hidden trapdoor in the system!
If exploited, an attacker could take complete control of affected systems, running malicious code as if they were a trusted user. This could lead to data breaches, unauthorized access to sensitive information, and even the complete takeover of the machine—absolutely devastating! ⚡ To safeguard your systems, ensure you immediately apply the security patches provided by Microsoft for this vulnerability. Additionally, review and restrict user access to sensitive areas of the file system to minimize exposure. You've got this! Follow these steps to secure your systems and protect against this risk. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/windows_10_1507 | < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft/windows_10_1507 | < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft/windows_10_1607 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft/windows_10_1607 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft/windows_10_1809 | < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft/windows_10_1809 | < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft/windows_10_21h2 | < 10.0.19044.5608 | 10.0.19044.5608 |
| microsoft/windows_10_21h2 | < 10.0.19044.5608 | 10.0.19044.5608 |
| microsoft/windows_10_21h2 | < 10.0.19044.5608 | 10.0.19044.5608 |
| microsoft/windows_10_22h2 | < 10.0.19045.5608 | 10.0.19045.5608 |
| microsoft/windows_10_22h2 | < 10.0.19045.5608 | 10.0.19045.5608 |
| microsoft/windows_10_22h2 | < 10.0.19045.5608 | 10.0.19045.5608 |
| microsoft/windows_11_22h2 | < 10.0.22621.5039 | 10.0.22621.5039 |
| microsoft/windows_11_22h2 | < 10.0.22621.5039 | 10.0.22621.5039 |
| microsoft/windows_11_23h2 | < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft/windows_11_23h2 | < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft/windows_11_24h2 | < 10.0.26100.3403 | 10.0.26100.3403 |
| microsoft/windows_11_24h2 | < 10.0.26100.3403 | 10.0.26100.3403 |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2016 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft/windows_server_2019 | < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft/windows_server_2022 | < 10.0.20348.3270 | 10.0.20348.3270 |
| microsoft/windows_server_2022_23h2 | < 10.0.25398.1486 | 10.0.25398.1486 |
| microsoft/windows_server_2025 | < 10.0.26100.3403 | 10.0.26100.3403 |