CVE-2025-24985
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-24985 is an integer overflow or wraparound vulnerability (CWE-122, CWE-190) in the Windows Fast FAT Driver, a component of Microsoft Windows used for handling Fast FAT file systems. Published on March 11, 2025, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
The vulnerability can be exploited by an unauthorized local attacker with no privileges required. Exploitation involves low complexity and user interaction, such as tricking a user into opening a malicious file or performing a specific action on a Fast FAT volume. Successful exploitation allows arbitrary code execution in the context of the affected driver, potentially leading to full system compromise.
Microsoft's advisory at msrc.microsoft.com provides patching guidance through Windows Update. Vicarius offers detection and mitigation scripts specifically for this vulnerability. The issue is listed in CISA's Known Exploited Vulnerabilities catalog, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 11 March 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Integer overflow in Windows Fast FAT driver enables arbitrary code execution in kernel context via malicious file or volume action (T1204.002), directly facilitating local privilege escalation to full system compromise with no initial privileges required (T1068).