Cyber Posture

CVE-2025-24985

HighCISA KEVActive ExploitationPublic PoC

Published: 11 March 2025

Published
11 March 2025
Modified
27 October 2025
KEV Added
11 March 2025
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0186 83.1th percentile
Risk Priority 37 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-24985 is an integer overflow or wraparound vulnerability (CWE-122, CWE-190) in the Windows Fast FAT Driver, a component of Microsoft Windows used for handling Fast FAT file systems. Published on March 11, 2025, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

The vulnerability can be exploited by an unauthorized local attacker with no privileges required. Exploitation involves low complexity and user interaction, such as tricking a user into opening a malicious file or performing a specific action on a Fast FAT volume. Successful exploitation allows arbitrary code execution in the context of the affected driver, potentially leading to full system compromise.

Microsoft's advisory at msrc.microsoft.com provides patching guidance through Windows Update. Vicarius offers detection and mitigation scripts specifically for this vulnerability. The issue is listed in CISA's Known Exploited Vulnerabilities catalog, indicating real-world exploitation.

Details

CWE(s)
CWE-122CWE-190
KEV Date Added
11 March 2025

Affected Products

microsoft
windows 10 1507
≤ 10.0.10240.20947 · ≤ 10.0.10240.20947
microsoft
windows 10 1607
≤ 10.0.14393.7876 · ≤ 10.0.14393.7876
microsoft
windows 10 1809
≤ 10.0.17763.7009 · ≤ 10.0.17763.7009
microsoft
windows 10 21h2
≤ 10.0.19044.5608
microsoft
windows 10 22h2
≤ 10.0.19045.5608
microsoft
windows 11 22h2
≤ 10.0.22621.5039
microsoft
windows 11 23h2
≤ 10.0.22631.5039
microsoft
windows 11 24h2
≤ 10.0.26100.3403
microsoft
windows server 2008
all versions, r2
microsoft
windows server 2012
all versions, r2
+5 more product configuration(s) — see NVD for full list

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Integer overflow in Windows Fast FAT driver enables arbitrary code execution in kernel context via malicious file or volume action (T1204.002), directly facilitating local privilege escalation to full system compromise with no initial privileges required (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References