CVE-2025-24984
Microsoft Windows NTFS Information Disclosure Vulnerability
Description
CVE-2025-24984 is a medium-severity information disclosure vulnerability in the Windows NTFS file system that results from the insertion of sensitive data into log files. An attacker with physical access to a system can extract sensitive information from NTFS log structures by connecting a malicious USB storage device. With a CVSS v3.1 score of 4.6 and a MEDIUM severity rating, the vulnerability is limited to confidentiality impact but requires only physical access with no authentication. CISA has added CVE-2025-24984 to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2025-04-01, and its EPSS score of 4.97% at the 89.5th percentile indicates notable exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20947 |
| microsoft | windows 10 1607 | < 10.0.14393.7876 |
| microsoft | windows 10 1809 | < 10.0.17763.7009 |
| microsoft | windows 10 21h2 | < 10.0.19044.5608 |
| microsoft | windows 10 22h2 | < 10.0.19045.5608 |
| microsoft | windows 11 22h2 | < 10.0.22621.5039 |
| microsoft | windows 11 23h2 | < 10.0.22631.5039 |
| microsoft | windows 11 24h2 | < 10.0.26100.3403 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7876 |
| microsoft | windows server 2019 | < 10.0.17763.7009 |
| microsoft | windows server 2022 | < 10.0.20348.3270 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1486 |
| microsoft | windows server 2025 | < 10.0.26100.3403 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984(US Government Resource)
Weakness Type
CWE-532: Insertion of Sensitive Information into Log File
CVE-2025-24984 is classified under CWE-532 (Insertion of Sensitive Information into Log File), which occurs when sensitive data is written to log files that may be accessible to unauthorized parties. In Windows NTFS, the file system writes sensitive information such as file paths, metadata, or memory contents into NTFS log structures that can be read by an attacker with physical access to the storage device.
Learn more: CWE-532 — Insertion of Sensitive Information into Log File
Impact Analysis
The impact of CVE-2025-24984 is limited to confidentiality but involves a unique physical attack vector. The vulnerability requires physical access (AV:P) with low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). Confidentiality (High): By connecting a specially crafted USB device to a target system, an attacker can cause the NTFS driver to write sensitive information into log structures that are then readable from the physical storage. This can include file paths, metadata, partial file contents, and NTFS internal data structures. Integrity and Availability remain unaffected. Although the CVSS score of 4.6 (MEDIUM) is moderate due to the physical access requirement, the EPSS score of 4.97% at the 89.5th percentile indicates meaningful exploitation activity, suggesting this vulnerability is used in targeted physical access scenarios or insider threat operations.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-24984 by including it in the Known Exploited Vulnerabilities catalog. Despite the physical access requirement, the EPSS score of 4.97% at the 89.5th percentile — placing it in the top 11% of all vulnerabilities — indicates notable exploitation activity. This suggests the vulnerability is being used in targeted scenarios involving physical access, such as insider threats, evil maid attacks, or supply chain compromise of storage devices. The ransomware association is classified as unknown. No public exploit code has been identified in the available references, but the active exploitation confirmation and relatively high EPSS percentile for a physical-access vulnerability indicate that weaponized exploits exist and are being used in targeted operations.
Remediation
-
Apply the March 2025 security update from Microsoft. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The patch addresses the sensitive information logging behavior in the NTFS driver and is available through Windows Update, WSUS, or the Microsoft Update Catalog.
-
Implement physical security controls to restrict unauthorized USB device connections. Deploy USB device control policies via Group Policy or endpoint protection solutions to block unknown storage devices from being connected to sensitive systems.
-
Enable USB device audit logging to track all storage device connections. Configure Windows Event Log policies to capture USB mount events (Event IDs 20001, 20003) and correlate with user activity to detect potential exploitation attempts.
-
Encrypt sensitive volumes using BitLocker or equivalent full-disk encryption to protect data at rest. Even if NTFS log structures contain sensitive information, encryption prevents offline access by attackers with physical access to the storage.
-
Review NTFS log files on systems that may have been exposed to untrusted USB devices. Check for evidence of sensitive data leakage in NTFS journal and log structures, and consider secure erasure of potentially compromised log data.
Technical Details
CVE-2025-24984 is an information disclosure vulnerability in the Windows NTFS file system where sensitive data is inserted into log files, classified under CWE-532. The CVSS v3.1 vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects the physical access requirement (AV:P). The vulnerability exists in the NTFS journaling and logging mechanism, which records file system operations for crash recovery and consistency purposes. Under specific conditions triggered by a maliciously crafted storage device, the NTFS driver writes sensitive information — including file paths, partial file contents, metadata, and internal data structures — into NTFS log files ($LogFile or $UsnJrnl) in a manner that makes this data accessible to an attacker with physical access. When a specially crafted USB storage device is connected, it triggers NTFS operations that cause the driver to log more information than intended, and this logged data can then be read by the attacker through the physical device. The physical attack vector limits remote exploitation but makes this vulnerability relevant for insider threats, targeted physical access attacks, and supply chain scenarios involving compromised storage devices.
Frequently Asked Questions
Is CVE-2025-24984 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2025-24984 by adding it to the KEV catalog. Despite requiring physical access, the EPSS score of 4.97% at the 89.5th percentile indicates notable exploitation activity in targeted physical-access scenarios.
What products are affected by CVE-2025-24984?
The vulnerability affects Microsoft Windows 10 (all supported versions), Windows 11 22H2/23H2/24H2, and Windows Server 2012 through 2025. Systems running NTFS that may be exposed to untrusted physical storage devices are at risk.
How do I fix CVE-2025-24984?
Apply the March 2025 Microsoft security update. Implement USB device control policies to block unauthorized storage devices, enable BitLocker full-disk encryption, and configure USB device audit logging to detect suspicious device connections.
How severe is CVE-2025-24984?
CVE-2025-24984 has a CVSS score of 4.6 (MEDIUM), limited by the physical access requirement. However, it is actively exploited and valuable in targeted attacks involving physical access, insider threats, or supply chain compromise of storage devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.