CVE-2025-24993
Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability
Description
CVE-2025-24993 is a high-severity heap-based buffer overflow vulnerability in the Windows NTFS file system driver that allows an unauthorized attacker to execute arbitrary code locally. The vulnerability affects virtually all supported versions of Windows, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2025. With a CVSS v3.1 score of 7.8 and an EPSS score of 1.48% at the 81st percentile, CISA has added CVE-2025-24993 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20947 |
| microsoft | windows 10 1607 | < 10.0.14393.7876 |
| microsoft | windows 10 1809 | < 10.0.17763.7009 |
| microsoft | windows 10 21h2 | < 10.0.19044.5608 |
| microsoft | windows 10 22h2 | < 10.0.19045.5608 |
| microsoft | windows 11 22h2 | < 10.0.22621.5039 |
| microsoft | windows 11 23h2 | < 10.0.22631.5039 |
| microsoft | windows 11 24h2 | < 10.0.26100.3403 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7876 |
| microsoft | windows server 2019 | < 10.0.17763.7009 |
| microsoft | windows server 2022 | < 10.0.20348.3270 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1486 |
| microsoft | windows server 2025 | < 10.0.26100.3403 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24993(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
CVE-2025-24993 is classified under CWE-122 (Heap-based Buffer Overflow), a vulnerability where a program writes more data to a heap-allocated buffer than its allocated size, corrupting adjacent heap structures. In the Windows NTFS driver, a heap buffer overflow condition allows an attacker to corrupt heap memory during file system operations, potentially overwriting function pointers or heap metadata to achieve arbitrary code execution. Heap-based buffer overflows in kernel-level file system drivers are particularly dangerous because they execute with elevated system privileges.
Learn more: CWE-122 — Heap-based Buffer Overflow
Impact Analysis
CVE-2025-24993 has high impact across all CIA dimensions on affected Windows systems. The vulnerability requires local access (AV:L) with no privileges (PR:N) but does require user interaction (UI:R), indicating the attack likely involves tricking a user into mounting a specially crafted disk image or accessing a malicious NTFS volume. Confidentiality (High) is compromised as code execution in the NTFS driver context operates at kernel level, granting access to all data on the system. Integrity (High) is impacted because kernel-level code execution allows modification of any system component, installation of rootkits, and bypassing all security controls. Availability (High) is at risk as the attacker can corrupt the file system, cause system crashes, or render the system unbootable. The EPSS score of 1.48% at the 81st percentile indicates elevated exploitation probability, and the extremely broad attack surface — affecting every supported Windows version — makes this vulnerability impactful across enterprise environments.
Exploit Maturity
CVE-2025-24993 has confirmed active exploitation, as CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 1, 2025. The Microsoft Security Response Center advisory provides the vendor disclosure and patch information. The EPSS score of 1.48% at the 81st percentile indicates elevated exploitation activity. NTFS vulnerabilities are particularly attractive to threat actors because the file system driver operates at the kernel level, and exploitation through crafted disk images or USB devices can bypass many endpoint security controls. The user interaction requirement (mounting a crafted volume) suggests attack scenarios involving phishing with malicious disk images, compromised USB devices, or network-shared malicious volumes.
Remediation
-
Apply the March 2025 Microsoft security updates immediately across all affected Windows versions. Consult the Microsoft advisory for CVE-2025-24993 for specific KB articles and update guidance for each Windows version.
-
Restrict USB and removable media access through Group Policy or endpoint management solutions to reduce the attack surface. Disable automount for external storage devices and block the mounting of unverified disk images.
-
Implement email and web filtering to block common delivery mechanisms for malicious disk images. Filter file types commonly used as exploit delivery vectors (.vhd, .vhdx, .img, .iso) at email gateways and web proxies unless specifically required for business operations.
-
Deploy endpoint detection and response (EDR) solutions that monitor for suspicious NTFS driver behavior, heap corruption indicators, and anomalous kernel activity. Configure alerts for unexpected disk image mounting events and NTFS parsing errors.
-
Prioritize patching Windows Server environments, particularly domain controllers, file servers, and systems that process external storage media, as these represent the highest-value targets for kernel-level exploitation.
Technical Details
CVE-2025-24993 is a heap-based buffer overflow in the Windows NTFS file system driver. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a local attack requiring user interaction (likely mounting a crafted volume) with no privilege requirements and high impact across all CIA dimensions. The vulnerability resides in the NTFS driver's parsing logic, where specially crafted NTFS metadata causes the driver to write beyond the bounds of a heap-allocated buffer during file system operations. Since the NTFS driver executes in kernel mode (Ring 0), successful heap corruption can overwrite kernel data structures, function pointers, or adjacent allocations to redirect execution flow, achieving arbitrary code execution with SYSTEM privileges. The breadth of affected products is extensive, spanning Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server (2008, 2012, 2016, 2019, 2022, 2022 23H2, 2025), reflecting the NTFS driver's shared codebase across the entire Windows ecosystem.
Frequently Asked Questions
Is CVE-2025-24993 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-24993 to the Known Exploited Vulnerabilities catalog. The EPSS score of 1.48% at the 81st percentile indicates elevated exploitation activity against Windows systems.
What products are affected by CVE-2025-24993?
Virtually all supported Windows versions are affected: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server (2008, 2012, 2016, 2019, 2022, 2022 23H2, 2025). Specific version thresholds vary by edition.
How do I fix CVE-2025-24993?
Apply the March 2025 Microsoft security updates through Windows Update or WSUS. As an interim measure, restrict removable media access and block disk image file types at email gateways and web proxies.
How severe is CVE-2025-24993?
CVE-2025-24993 is rated High with a CVSS score of 7.8. The heap buffer overflow in the NTFS driver enables kernel-level code execution, which allows complete system compromise with SYSTEM privileges. The universal impact across all Windows versions amplifies the severity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.