CVE-2025-24993

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-24993 7.8

Microsoft · Windows · Added 2025-03-11 · Published 2025-03-11

3-Day Required KEV Active Exploitation

Details

VulnerabilityMicrosoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

VendorMicrosoft

ProductWindows

Date added2025-03-11

Due date2025-04-01

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-122

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.

NVD: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-14 10:14 UTC

Wall time0.4s

Searches1

Component defaultunknown

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993
https://nvd.nist.gov/vuln/detail/CVE-2025-24993
https://www.cve.news/cve-2025-24993/
https://swarm.ptsecurity.com/buried-in-the-log-exploiting-a-20-years-old-ntfs-vulnerability/
https://www.zerosday.com/post/cves/cve-2025-24993-windows-lab
https://markaicode.com/windows-kernel-cve-2025-24993-ntfs-heap-overflow-vulnerability-patching/
https://www.sans.org/newsletters/at-risk/xxv-10
https://www.sentinelone.com/vulnerability-database/cve-2025-24991/

Hunting hypothesis agent

Monitor for abnormal NTFS heap allocation patterns or unexpected file system crashes on Windows endpoints, indicating an attempt to exploit the heap-based buffer overflow in the NTFS driver.

Research details

ComponentNTFS.sys driver (NTFS file system driver)

PreconditionsThe attacker must have local access to the target system or trick a user into mounting a specially crafted Virtual Hard Disk (VHD) file. User interaction is required (CVSS: UI:R) — the victim must open or mount the malicious VHD, which can be delivered via phishing emails, malicious USB drives, or downloaded archives. The target must be running a vulnerable, unpatched version of Windows with the NTFS driver (ntfs.sys) enabled. No elevated privileges are required beyond standard user access (CVSS: PR:N), but the attack vector is local (AV:L). Once the VHD is mounted, the NTFS driver's heap buffer overflow is triggered during parsing of crafted on-disk metadata, leading to kernel memory corruption that can be leveraged for arbitrary code execution with SYSTEM privileges. agent

DeliverySpecially crafted Virtual Hard Disk (VHD) file delivered via phishing emails, malicious USB drives, or downloaded archives, mounted by the victim to trigger the heap overflow in the NTFS driver

Public PoCno

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993

Exploit notesCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — Low attack complexity but requires user interaction via mounting a malicious VHD file. No privileges required pre-exploitation. The vulnerability resides in ntfs.sys and is triggered during volume mount operations. Real-world exploitation involves crafting a VHD with malformed LFS (Log File System) structures to trigger an integer overflow in the ntfs!LfsFindLogRecord function, bypassing length checks and causing a heap buffer overflow. The PT SWARM analysis details the exploitation chain but no public weaponized PoC code is available.

SummaryCVE-2025-24993 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows NTFS.sys driver that allows an unauthorized local attacker to execute arbitrary code with SYSTEM privileges by tricking a user into mounting a specially crafted Virtual Hard Disk (VHD) file.

Tia coverage

First reported2026-10-10

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

windows-ntfs-heap-buffer-overflow-cve-2025-24993-actively-exploi

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.