CVE-2025-24061
Published: 11 March 2025
Description
Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.
Security Summary
CVE-2025-24061 is a protection mechanism failure in the Windows Mark of the Web (MOTW) feature, enabling an unauthorized attacker to bypass a security feature locally. This vulnerability affects Windows systems and is classified under CWE-693. It received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impacts despite requiring local access and user interaction.
An unauthorized attacker with local access to a vulnerable Windows system can exploit this issue with low attack complexity and no required privileges, though user interaction is necessary. Successful exploitation allows the attacker to bypass MOTW protections, potentially leading to high confidentiality, integrity, and availability impacts, such as executing malicious content that would otherwise be blocked.
Microsoft's update guide provides details on mitigations and patches for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24061. Security practitioners should consult this advisory for specific remediation steps.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a direct bypass of the Windows Mark of the Web (MOTW) protection mechanism, enabling execution of otherwise blocked malicious content; this maps precisely to T1553.005 Mark-of-the-Web Bypass.