CVE-2025-24991
Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability
Description
CVE-2025-24991 is a medium-severity out-of-bounds read vulnerability in the Windows NTFS file system driver. The flaw allows an attacker with physical or local access to trick a user into mounting a specially crafted VHD file, which can disclose sensitive information stored in NTFS heap memory. With a CVSS v3.1 score of 5.5 and a MEDIUM severity rating, this vulnerability primarily threatens data confidentiality. CISA has added CVE-2025-24991 to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2025-04-01, and its EPSS score of 0.71% at the 71.9th percentile signals meaningful exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20947 |
| microsoft | windows 10 1607 | < 10.0.14393.7876 |
| microsoft | windows 10 1809 | < 10.0.17763.7009 |
| microsoft | windows 10 21h2 | < 10.0.19044.5608 |
| microsoft | windows 10 22h2 | < 10.0.19045.5608 |
| microsoft | windows 11 22h2 | < 10.0.22621.5039 |
| microsoft | windows 11 23h2 | < 10.0.22631.5039 |
| microsoft | windows 11 24h2 | < 10.0.26100.3403 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7876 |
| microsoft | windows server 2019 | < 10.0.17763.7009 |
| microsoft | windows server 2022 | < 10.0.20348.3270 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1486 |
| microsoft | windows server 2025 | < 10.0.26100.3403 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24991(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
CVE-2025-24991 is classified under CWE-125 (Out-of-bounds Read), which occurs when software reads data past the end or before the beginning of a buffer boundary. In the Windows NTFS driver, this manifests when parsing specially crafted file system structures causes the driver to read memory beyond allocated boundaries, potentially exposing sensitive kernel data including credentials, encryption keys, or memory layout information.
Learn more: CWE-125 — Out-of-bounds Read
Impact Analysis
The impact of CVE-2025-24991 centers on confidentiality, with a high rating for information disclosure. The vulnerability is locally exploitable (AV:L) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R) in the form of mounting a crafted VHD file. Confidentiality (High): An attacker can read sensitive data from NTFS heap memory, potentially including file contents, credentials, encryption keys, and other data structures stored in kernel memory. Integrity and Availability are not directly impacted by this vulnerability. With a CVSS score of 5.5 (MEDIUM) and an EPSS score of 0.71% at the 71.9th percentile, the vulnerability is actively exploited in the wild despite its moderate severity rating, likely because it is chained with other NTFS vulnerabilities for more complete system compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-24991 by adding it to the Known Exploited Vulnerabilities catalog, indicating that threat actors are using this Windows NTFS out-of-bounds read vulnerability in real-world attacks. The EPSS score of 0.71% at the 71.9th percentile reflects meaningful exploitation activity, though at a lower level than some of the related NTFS vulnerabilities patched in the same cycle. While the ransomware association is currently classified as unknown, this vulnerability is likely used as part of a chained attack alongside other NTFS vulnerabilities such as CVE-2025-24993 and CVE-2025-24984 to achieve information disclosure that facilitates further exploitation. No public proof-of-concept exploit code has been identified in the available references, but the active exploitation status confirms that threat actors possess working exploits.
Remediation
-
Apply the March 2025 security update from Microsoft immediately. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The specific patches are available through Windows Update, WSUS, or the Microsoft Update Catalog for all affected Windows versions.
-
Restrict VHD file handling across the organization. Configure Group Policy to block auto-mounting of virtual hard disk files from untrusted sources, and implement email gateway rules to quarantine or block VHD/VHDX file attachments.
-
Implement application control policies using Windows Defender Application Control (WDAC) or AppLocker to prevent execution of untrusted disk image files. Block mounting of VHD files received via email, web downloads, or removable media.
-
Monitor for exploitation indicators by reviewing Windows Event Logs for unusual VHD mount operations, particularly from user profile directories, temporary folders, or email attachment paths. Deploy endpoint detection rules targeting suspicious NTFS driver behavior.
-
Audit affected systems for signs of compromise, particularly systems where users may have opened suspicious VHD files. Check for unauthorized data access, credential theft, or lateral movement following exploitation.
Technical Details
CVE-2025-24991 is an out-of-bounds read vulnerability in the Windows NTFS file system driver with the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability occurs when the NTFS driver processes specially crafted file system metadata structures that cause it to read memory beyond the bounds of an allocated buffer. When a user mounts a maliciously crafted virtual hard disk (VHD) file containing manipulated NTFS structures, the driver attempts to parse metadata fields that reference memory offsets beyond the allocated buffer boundary. This out-of-bounds read operation can return sensitive data from adjacent kernel memory, including portions of other file contents, cached credentials, encryption keys, and internal NTFS data structures. The local attack vector (AV:L) with user interaction required (UI:R) reflects the need for a victim to mount the malicious VHD, while the high confidentiality impact (C:H) and absence of integrity or availability impact (I:N/A:N) confirm this as a pure information disclosure vulnerability that exposes kernel heap contents.
Frequently Asked Questions
Is CVE-2025-24991 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2025-24991 by adding it to the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.71% at the 71.9th percentile indicates meaningful exploitation activity. The ransomware association is currently unknown.
What products are affected by CVE-2025-24991?
The vulnerability affects a wide range of Microsoft Windows versions including Windows 10 (all supported versions), Windows 11 22H2/23H2/24H2, and Windows Server 2008 through 2025. All systems running NTFS should be considered potentially affected.
How do I fix CVE-2025-24991?
Apply the March 2025 Microsoft security update through Windows Update or WSUS. Additionally, restrict VHD file handling via Group Policy and implement email gateway filtering for VHD attachments to reduce the attack surface.
How severe is CVE-2025-24991?
CVE-2025-24991 has a CVSS score of 5.5 (MEDIUM), primarily impacting confidentiality. While rated as medium severity, its active exploitation status and position at the 71.9th EPSS percentile indicate it poses a significant real-world threat, particularly when chained with other NTFS vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.