Tia N.List

CTI · reviewed · 2026-10-11

Windows NTFS Heap Buffer Overflow CVE-2025-24993 Actively Exploited

Full story & timeline

Actors

—

Malware / tools

—

Campaigns

—

CVEs

CVE-2025-24991CVE-2025-24993

Victim sectors

enterpriseconsumer

Geography

global

MITRE ATT&CK

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Outbound SMB Traffic From Non-Domain Windows Hosts
id: 62309ca7-5ac0-46aa-be05-ea91ff2cebb2
status: experimental
description: >
    Detects outbound SMB (TCP 445) sessions to non-private destinations from
    a Windows host. CISA's KEV entry for CVE-2025-24993 (NTFS heap buffer
    overflow, exploited in the wild) and BOD 22-01 call for blocking outbound
    SMB from non-domain hosts to reduce exploitation and lateral movement
    vectors for this NTFS flaw; an outbound 445 session to an internet
    address is never normal for a managed domain workstation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24993
    - https://cybertop.ai/t/cve-2025-24993-microsoft-windows-ntfs-heap-based-buffer-overflow-vulne
author: Tia N. List
date: 2026/10/11
tags:
    - attack.t1203
    - attack.t1068
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 445
        Protocol: tcp
    filter_private:
        DestinationIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
            - '224.0.0.0/4'
    condition: selection and not filter_private
falsepositives:
    - SMB sessions to external partners routed over tunnels that hide the private destination from the sensor
    - Egress monitoring that records the tunnel endpoint rather than the true SMB peer
level: medium

References

Source on GitHub