CVE-2025-24990
Microsoft Windows Untrusted Pointer Dereference Vulnerability
Description
CVE-2025-24990 is a high-severity elevation of privilege vulnerability (CVSS 7.8) affecting multiple versions of Microsoft Windows, specifically the legacy Agere Modem driver (ltmdm64.sys) that ships natively with the operating system. The flaw stems from an untrusted pointer dereference (CWE-822) in the driver, allowing a local, low-privileged attacker to escalate privileges to SYSTEM-level access without any user interaction. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of November 4, 2025, and its EPSS score of 6.43% places it in the 90.9th percentile, indicating a significantly elevated probability of active exploitation. Microsoft has addressed the issue by removing the vulnerable driver in the October cumulative update.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.21161 |
| microsoft | windows 10 1607 | < 10.0.14393.8519 |
| microsoft | windows 10 1809 | < 10.0.17763.7919 |
| microsoft | windows 10 21h2 | < 10.0.19044.6456 |
| microsoft | windows 10 22h2 | < 10.0.19045.6456 |
| microsoft | windows 11 22h2 | < 10.0.22621.6060 |
| microsoft | windows 11 23h2 | <= 10.0.22631.6060 |
| microsoft | windows 11 24h2 | < 10.0.26100.6899 |
| microsoft | windows 11 25h2 | < 10.0.26200.6899 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | <= 10.0.14393.8519 |
| microsoft | windows server 2019 | < 10.0.17763.7919 |
| microsoft | windows server 2022 | < 10.0.20348.4294 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1913 |
| microsoft | windows server 2025 | <= 10.0.26100.6899 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-24990-detection-script-elevation-of-privilege-vulnerability-in-agere-modem-driver-affecting-windows(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-24990-mitigation-script-elevation-of-privilege-vulnerability-in-agere-modem-driver-affecting-windows(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24990(US Government Resource)
Weakness Type
CWE-822: Untrusted Pointer Dereference
CWE-822 describes a vulnerability where software dereferences a pointer that was provided or influenced by an untrusted source, without adequate validation. In the context of CVE-2025-24990, the Agere Modem driver (ltmdm64.sys) processes pointer values from a source that a local attacker can manipulate, leading to arbitrary memory access and ultimately privilege escalation. An attacker who controls the pointer value can redirect execution flow to gain SYSTEM-level privileges on the affected Windows host. This weakness class is particularly dangerous in kernel-mode drivers because exploitation yields the highest privilege level on the system.
Impact Analysis
The business impact of CVE-2025-24990 is substantial. An attacker who already has low-level access to a Windows machine—for example, through phishing, compromised credentials, or a prior intrusion—can exploit this vulnerability to gain full SYSTEM-level control. Confidentiality is fully compromised because the attacker can read any file or registry value on the system, including credential stores, encryption keys, and sensitive business data. Integrity is equally at risk since the attacker can modify system configurations, install backdoors, tamper with logs, or alter security policies to maintain persistence. Availability can be severely disrupted through destructive actions such as encrypting files for ransom, corrupting system components, or disabling critical services.
With an EPSS score of 6.43% (90.9th percentile), this vulnerability has a meaningfully higher likelihood of exploitation compared to the average CVE. Its inclusion in the KEV catalog confirms that exploitation has been observed in the wild. While the ransomware association is currently listed as "Unknown," the local privilege escalation nature of this flaw makes it a valuable link in ransomware attack chains, where initial access is followed by privilege escalation to deploy payloads across the environment. Organizations running unpatched Windows systems with the legacy Agere Modem driver are at elevated risk and should prioritize remediation.
Exploit Maturity
CVE-2025-24990 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming that real-world exploitation has been observed. The KEV entry specifies a remediation deadline of November 4, 2025, underscoring the urgency. The EPSS score of 6.43% (90.9th percentile) places this vulnerability well above the median in terms of exploitation probability, meaning it is being actively targeted more than approximately 91% of all known vulnerabilities.
Public detection and mitigation scripts have been published by third-party security researchers at Vicarius (detection script) and Vicarius (mitigation script), which demonstrates community awareness and active interest in this vulnerability. The ransomware use status is currently listed as "Unknown" by CISA, but the privilege escalation capability makes it a high-value target for ransomware operators seeking to elevate from initial user-level access to full system control.
Remediation
-
Apply the latest Windows cumulative update immediately. Install the October cumulative update (or later) from Microsoft, which removes the vulnerable ltmdm64.sys Agere Modem driver entirely. Use Windows Update, WSUS, or your enterprise patch management solution to deploy the update across all affected systems. Specific minimum versions are: Windows 10 1507 (10.0.10240.21161), Windows 10 1607 (10.0.14393.8519), Windows 10 1809 (10.0.17763.7919), Windows 10 21H2/22H2 (10.0.19044.6456 / 10.0.19045.6456), Windows 11 22H2 (10.0.22621.6060), Windows 11 23H2 (10.0.22631.6060), and Windows 11 24H2 (10.0.26100.6899).
-
Verify removal of the vulnerable driver. After patching, confirm that the ltmdm64.sys file has been removed from the system. You can check by searching for the file in the
C:\Windows\System32\drivers\directory or by running the detection script provided by Vicarius. -
Audit systems for signs of exploitation. Review security logs for suspicious privilege escalation events, unexpected driver loading, or anomalous SYSTEM-level process creation that may indicate prior exploitation. Pay particular attention to systems that were unpatched during the period of known active exploitation.
-
Retire legacy fax modem hardware. Since the vulnerable Agere Modem driver has been permanently removed by Microsoft, any fax modem hardware that depends on this specific driver will no longer function. Identify and decommission any remaining devices that relied on ltmdm64.sys and transition to supported alternatives.
-
Enforce least-privilege access policies. Because exploitation requires local, low-privileged access, limiting unnecessary local user accounts, enforcing strong authentication, and applying the principle of least privilege will reduce the attack surface for this and similar local privilege escalation vulnerabilities.
Technical Details
The CVSS v3.1 vector for CVE-2025-24990 is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 7.8 (High). Attack Vector (AV:L) indicates the attacker must have local access to the target system; this is not remotely exploitable over the network. Attack Complexity (AC:L) means no special conditions or race conditions are required—exploitation is straightforward once local access is obtained. Privileges Required (PR:L) confirms that only a low-privileged user account is needed, not administrative access. User Interaction (UI:N) specifies that no victim action such as clicking a link or opening a file is required. Scope (S:U) indicates the vulnerability is contained within the vulnerable component's security authority, though the practical impact is full SYSTEM-level access. Confidentiality, Integrity, and Availability are all rated High (C:H/I:H/A:H), reflecting complete compromise of the affected system.
The underlying technical mechanism involves the ltmdm64.sys Agere Modem driver, a legacy kernel-mode driver that has shipped with Windows since earlier versions. The driver contains a flaw where it dereferences a pointer value from an untrusted source (CWE-822) without proper validation. A local attacker can craft input that causes the driver to follow a malicious pointer, leading to arbitrary kernel memory access. Because kernel-mode drivers operate at the highest privilege level in Windows, successful exploitation grants the attacker SYSTEM-level privileges, bypassing all user-mode security boundaries. Microsoft's remediation approach was to remove the driver entirely from Windows through the October cumulative update, rather than patching the driver code, reflecting the legacy and non-essential nature of the component.
Frequently Asked Questions
What is CVE-2025-24990?
CVE-2025-24990 is a high-severity elevation of privilege vulnerability in the Agere Modem driver (ltmdm64.sys) that ships with Microsoft Windows. It allows a local attacker with low-level privileges to escalate to SYSTEM-level access by exploiting an untrusted pointer dereference in the kernel-mode driver. Microsoft has addressed it by removing the driver in the October cumulative update.
Is CVE-2025-24990 being exploited in the wild?
Yes. CISA has added CVE-2025-24990 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The remediation deadline is set for November 4, 2025, and the EPSS score of 6.43% (90.9th percentile) further indicates elevated exploitation activity compared to most CVEs.
Which Windows versions are affected?
CVE-2025-24990 affects a wide range of Windows versions including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H2, 23H2, 24H2). Any system running an unpatched version with the ltmdm64.sys driver present is vulnerable. Specific patch version thresholds are provided in Microsoft's advisory.
Will patching break my fax modem?
Yes, fax modem hardware that specifically depends on the ltmdm64.sys Agere Modem driver will no longer function after the patch is applied, because Microsoft's fix removes the driver entirely rather than updating it. Organizations still using such hardware should plan to transition to supported alternatives before or immediately after applying the update.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.