CVE-2025-24990
Published: 14 October 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24990 affects the third-party Agere Modem driver, specifically ltmdm64.sys, which ships natively with supported Windows operating systems. This vulnerability, associated with CWE-822 (Untrusted Pointer Dereference), has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has announced the removal of the driver due to these issues, with the driver already excised in the October cumulative update.
A local attacker with low privileges can exploit the vulnerability through low-complexity means requiring no user interaction. Exploitation enables high-impact consequences on confidentiality, integrity, and availability, facilitating elevation of privilege on affected Windows systems.
Microsoft advisories state that the ltmdm64.sys driver has been removed via the October cumulative update, rendering dependent fax modem hardware non-functional on Windows. The company recommends eliminating any existing dependencies on this hardware. Additional guidance includes detection and mitigation scripts from Vicarius, with the vulnerability documented on MSRC and listed in CISA's Known Exploited Vulnerabilities Catalog.
The presence in CISA's KEV catalog indicates active real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 14 October 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables local low-privileged attackers to achieve privilege escalation via exploitation of the vulnerable driver (CWE-822), directly mapping to T1068: Exploitation for Privilege Escalation.