CVE-2025-24991
Published: 11 March 2025
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2025-24991 is an out-of-bounds read vulnerability (CWE-125) in the Windows NTFS file system. It affects Windows operating systems that utilize NTFS and was published on 2025-03-11 with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
The vulnerability can be exploited by a local attacker requiring no privileges, though user interaction is necessary and attack complexity is low. Successful exploitation allows the attacker to disclose sensitive information locally with high confidentiality impact, without affecting integrity or availability.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991 provides details on the vulnerability and mitigation recommendations, including available patches. It is also listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24991, indicating active exploitation in the wild.
Details
- CWE(s)
- KEV Date Added
- 11 March 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The out-of-bounds read in NTFS directly enables local disclosure of sensitive information from the system, mapping to Data from Local System.