CVE-2025-24984
Published: 11 March 2025
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2025-24984 is a vulnerability in the Windows NTFS file system that involves the insertion of sensitive information into a log file, classified under CWE-532. Published on 2025-03-11, it carries a CVSS v3.1 base score of 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting a medium-severity issue where sensitive data exposure occurs via physical means.
An unauthorized attacker with physical access to the affected system can exploit this vulnerability with low attack complexity, requiring no privileges, user interaction, or scope changes. Exploitation enables high-impact disclosure of confidential information from the log file, without impacting integrity or availability.
Microsoft's update guide addresses mitigation for CVE-2025-24984 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984.
Details
- CWE(s)
- KEV Date Added
- 11 March 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability causes sensitive information to be logged in an NTFS log file, enabling an attacker with physical access to collect confidential data directly from the local system.