CVE-2025-24993
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-24993 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting the Windows NTFS file system component. Published on 2025-03-11T17:16:35.797, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute arbitrary code locally on affected Windows systems.
Exploitation requires local access to the target machine with no special privileges, low attack complexity, and user interaction, such as opening a malicious file. A successful attack allows the attacker to achieve high-impact effects on confidentiality, integrity, and availability through local code execution, though it does not result in privilege escalation.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993 provides details on patches and mitigations. The vulnerability appears in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24993, signaling real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 11 March 2025
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a local heap buffer overflow in NTFS triggered by opening a malicious file, directly enabling user execution of arbitrary code without requiring privileges or remote access.