CVE-2025-24991

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-24991 5.5

Microsoft · Windows · Added 2025-03-11 · Published 2025-03-11

KEV Active Exploitation

Details

VulnerabilityMicrosoft Windows NTFS Out-Of-Bounds Read Vulnerability

VendorMicrosoft

ProductWindows

Date added2025-03-11

Due date2025-04-01

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-125

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Descriptions

KEV: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.

NVD: Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Compliance SSVC + BOD 26-04

Automatableno

Technical impactpartial

Exploitation statusactive

3-day qualifyingNo

Public timeline14 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-14 10:14 UTC

Wall time0.6s

Searches1

Component defaultunknown

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991
https://nvd.nist.gov/vuln/detail/CVE-2025-24991
https://www.sentinelone.com/vulnerability-database/cve-2025-24991/
https://www.wiz.io/vulnerability-database/cve/cve-2025-24991
https://www.cve.news/cve-2025-24991/
https://www.rapid7.com/blog/post/2025/03/11/patch-tuesday-march-2025/
https://swarm.ptsecurity.com/buried-in-the-log-exploiting-a-20-years-old-ntfs-vulnerability/
https://www.sans.org/newsletters/at-risk/xxv-10

Hunting hypothesis agent

Monitor for unexpected NTFS read operations triggering access violations or information disclosure events on Windows systems, indicating exploitation of the NTFS out-of-bounds read vulnerability.

Research details

ComponentNTFS.sys driver (NTFS file system driver)

PreconditionsThe attacker must have local access as an authorized user and convince a victim to mount a specially crafted Virtual Hard Disk (VHD or VHDX) file. User interaction is required (CVSS: UI:R) — the victim must double-click or otherwise mount the malicious disk image, which can be delivered via phishing emails, removable media, or downloaded archives. The target must be running a vulnerable, unpatched version of Windows. When the VHD is mounted, Windows auto-mounts the volume and the NTFS parser (ntfs.sys) processes the crafted file system structures with insufficient boundary validation, causing an out-of-bounds read that leaks small portions of kernel heap memory. The leaked data, which may include pointers and allocation metadata, can be used to bypass KASLR in multi-stage attacks. agent

DeliverySpecially crafted Virtual Hard Disk (VHD/VHDX) file delivered via phishing emails, removable media, or downloaded archives, mounted by the victim to trigger the out-of-bounds read in the NTFS driver

Public PoCno

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991

Exploit notesCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N — Low attack complexity but requires user interaction to mount a malicious VHD/VHDX. No privileges required pre-exploitation. The vulnerability is an out-of-bounds read (CWE-125) in ntfs.sys caused by insufficient boundary validation when parsing metadata from a mounted volume. The leaked heap memory can help bypass KASLR but does not directly enable code execution — typically chained with other vulnerabilities for privilege escalation. No public weaponized PoC code is available.

SummaryCVE-2025-24991 is an out-of-bounds read (CWE-125) in the Microsoft Windows NTFS.sys driver that allows an authorized local attacker to disclose sensitive kernel heap memory by tricking a user into mounting a specially crafted Virtual Hard Disk (VHD) file.

Tia coverage

First reported2026-10-10

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

windows-ntfs-heap-buffer-overflow-cve-2025-24993-actively-exploi

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.