Windows NTFS Heap Buffer Overflow CVE-2025-24993 Actively Exploited

CVE-2025-24993 is a heap-based buffer overflow in the Windows NTFS driver (CWE-122), scored CVSS 3.1 7.8 HIGH with an AV:L / AC:L / PR:N / UI:R vector, meaning a local attacker who convinces a user to interact can execute code with the affected process privileges. The NVD entry published on 2025-03-11 lists affected builds across Windows 10 (1507 through 22H2, builds below 10.0.19045.5608), Windows 11 (22H2, 23H2, 24H2, builds below 10.0.22621.5039 / 10.0.26100.3476), and multiple Server editions including Server 2019 and 2022. CISA added the flaw to the Known Exploited Vulnerabilities Catalog on the same date, confirming active in-the-wild exploitation, and set a required-action due date of 2025-04-01. The original event notes an additional defensive control: block outbound SMB connections (port 445) from non-domain hosts per BOD 22-01 to reduce exploitation vectors for this NTFS flaw.

The exposure is broad because NTFS is the default file system for all modern Windows endpoints and servers; the affected version list spans desktop releases still in support and long-lived server installations, so any organization running unpatched Windows 10 or 11 builds is at risk. What makes this story stand out from the daily stream is the CISA KEV confirmation combined with a concrete vendor patch set: the vulnerability is not a theoretical driver bug but an actively exploited heap corruption with a defined remediation path, yet the event shows defensive takeaways limited to generic patching. A defender should treat it as a priority endpoint hardening task rather than a monitoring-only issue, because the local-privilege escalation path through NTFS gives an attacker a reliable post-interaction foothold.

Patch to the exact builds listed in the Microsoft advisory: Windows 10 22H2 must reach at least 10.0.19045.5608, Windows 11 24H2 at least 10.0.26100.3476, and corresponding Server builds per the NVD affected-product table. Where patching is delayed, enforce outbound SMB (port 445) restrictions from non-domain hosts as the event suggests, and audit for unauthorized local file interactions that could trigger the NTFS driver. Hunt telemetry should focus on anomalous local process spawning following NTFS-related file operations, and verify virtual-patch coverage against CVE-2025-24993 indicators. The CISA feed and NVD entry both reference the MSRC advisory URL for exact mitigation steps.

Watch for expanded exploitation telemetry that moves beyond the current local-user-interaction model, and for any update to the CISA required-action timeline or new companion vulnerabilities in the NTFS driver that could chain with this overflow. A shift to automated or remote exploitation would change the priority from endpoint patching to emergency containment.