CVE-2025-24985
Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability
Description
CVE-2025-24985 is a high-severity integer overflow vulnerability in the Microsoft Windows Fast FAT file system driver that can lead to a heap-based buffer overflow and arbitrary code execution. An attacker can exploit this vulnerability by convincing a user to mount a maliciously crafted FAT-formatted virtual hard disk (VHD), triggering the integer wraparound condition in the kernel driver. Rated 7.8 on the CVSS v3.1 scale with HIGH severity, successful exploitation grants the attacker full code execution in the context of the kernel. CISA has confirmed active exploitation by adding CVE-2025-24985 to the KEV catalog with a deadline of 2025-04-01, and its EPSS score of 0.94% at the 75.9th percentile reflects a significant exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20947 |
| microsoft | windows 10 1607 | < 10.0.14393.7876 |
| microsoft | windows 10 1809 | < 10.0.17763.7009 |
| microsoft | windows 10 21h2 | < 10.0.19044.5608 |
| microsoft | windows 10 22h2 | < 10.0.19045.5608 |
| microsoft | windows 11 22h2 | < 10.0.22621.5039 |
| microsoft | windows 11 23h2 | < 10.0.22631.5039 |
| microsoft | windows 11 24h2 | < 10.0.26100.3403 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7876 |
| microsoft | windows server 2019 | < 10.0.17763.7009 |
| microsoft | windows server 2022 | < 10.0.20348.3270 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1486 |
| microsoft | windows server 2025 | < 10.0.26100.3403 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985(Patch, Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-detection-script(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-24985-integer-overflow-vulnerability-in-microsoft-windows-fast-fat-driver-mitigation-script(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24985(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
CVE-2025-24985 is classified under CWE-122 (Heap-based Buffer Overflow), which occurs when a program writes data beyond the allocated heap buffer boundary. In the Windows Fast FAT Driver and NTFS, this manifests when processing malformed file system metadata causes memory corruption in heap-allocated structures, potentially allowing an attacker to overwrite adjacent memory and execute arbitrary code with kernel privileges.
Learn more: CWE-122 — Heap-based Buffer Overflow
CWE-190: Integer Overflow or Wraparound
CVE-2025-24985 is classified under CWE-190 (Integer Overflow or Wraparound), which occurs when an arithmetic operation produces a value that exceeds the maximum representable value for the integer type, causing it to wrap around. In the Windows Fast FAT Driver, an integer overflow in size calculations leads to undersized buffer allocations, which are then overflowed during subsequent write operations.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
The impact of CVE-2025-24985 is severe across all three dimensions of the CIA triad. The vulnerability is locally exploitable (AV:L) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R) to mount a malicious VHD. Confidentiality (High): Successful exploitation allows the attacker to read any data accessible to the kernel, including credentials, cryptographic keys, and sensitive application data. Integrity (High): The attacker gains arbitrary code execution in kernel mode, enabling modification of any file, registry key, or system configuration. Availability (High): The attacker can crash the system, corrupt the file system, or install persistent rootkits. With a CVSS score of 7.8 (HIGH) and an EPSS score of 0.94% at the 75.9th percentile, this vulnerability is being actively exploited, likely in conjunction with other NTFS/FAT driver vulnerabilities disclosed in the same Microsoft Patch Tuesday cycle.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-24985 by including it in the Known Exploited Vulnerabilities catalog, confirming that the Windows Fast FAT Driver integer overflow is being used in real-world attacks. The EPSS score of 0.94% at the 75.9th percentile indicates meaningful exploitation probability. Public exploit code is available for CVE-2025-24985 via Vicarius vSociety, which provides detection and mitigation scripts. While the ransomware association is classified as unknown, the vulnerability's ability to achieve kernel-level code execution through a crafted VHD file makes it a high-value target for advanced threat actors. The attack requires social engineering to convince a user to mount a malicious disk image, which aligns with observed spear-phishing campaigns distributing crafted VHD files.
Remediation
-
Apply the March 2025 security update from Microsoft as the highest priority action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Patches are available via Windows Update, WSUS, or the Microsoft Update Catalog for all affected Windows versions from Windows 10 through Windows Server 2025.
-
Block VHD and FAT-formatted disk image files at email gateways, web proxies, and endpoint security tools. Configure Group Policy to restrict auto-mounting of virtual disk images from untrusted locations.
-
Implement strict application control using WDAC or AppLocker to prevent mounting of disk images from user-writable directories. Consider disabling the ability for standard users to mount VHD files if not required for business operations.
-
Deploy detection rules for suspicious Fast FAT Driver activity, including monitoring for unusual VHD mount events, crash dumps involving fastfat.sys, and kernel exploitation indicators. Review systems for evidence of post-exploitation activity.
-
Address the underlying integer overflow pattern by ensuring all Windows systems receive cumulative updates that include the bounds checking improvements in the Fast FAT Driver, and validate that the mitigation scripts from Vicarius are applied on systems where immediate patching is not possible.
Technical Details
CVE-2025-24985 is an integer overflow vulnerability in the Windows Fast FAT file system driver with the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability originates in the driver's handling of FAT file system metadata, where an arithmetic operation on size or count fields produces a value that exceeds the maximum representable integer, wrapping around to a much smaller value (CWE-190). This undersized value is then used to allocate a heap buffer (CWE-122), which is subsequently overflowed when the actual, larger amount of data is written into it. The attack requires a user to mount a specially crafted virtual hard disk with a malformed FAT file system. When the Fast FAT Driver (fastfat.sys) parses the corrupted metadata, the integer overflow triggers a heap-based buffer overflow that corrupts adjacent kernel memory. An attacker can carefully control the overflow data to achieve arbitrary code execution in kernel mode. The local vector (AV:L) with user interaction (UI:R) and no privileges (PR:N) reflects the VHD mounting attack scenario, while the high impact across all CIA dimensions (C:H/I:H/A:H) confirms the potential for complete system compromise through kernel-level code execution.
Frequently Asked Questions
Is CVE-2025-24985 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2025-24985 to the KEV catalog with a remediation deadline of 2025-04-01. Public detection and mitigation scripts are available from Vicarius. The ransomware association is currently unknown.
What products are affected by CVE-2025-24985?
All supported versions of Microsoft Windows are affected, including Windows 10 1507 through 22H2, Windows 11 22H2/23H2/24H2, and Windows Server 2008 through 2025. The vulnerability is in the Fast FAT file system driver (fastfat.sys) present on all Windows systems.
How do I fix CVE-2025-24985?
Apply the March 2025 Microsoft security update immediately. Block VHD file attachments at email gateways, restrict VHD mounting for standard users via Group Policy, and implement application control policies to prevent unauthorized disk image mounting.
How severe is CVE-2025-24985?
CVE-2025-24985 has a CVSS score of 7.8 (HIGH) and enables arbitrary code execution in kernel mode through an integer overflow leading to heap buffer overflow. The EPSS score of 0.94% at the 75.9th percentile confirms active exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.