Cyber Resilience

CVE-2025-24084

High

Published: 11 March 2025

Published
11 March 2025
Modified
07 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 56.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24084 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 43.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-24084 is an untrusted pointer dereference vulnerability (CWE-822) in the Windows Subsystem for Linux (WSL). Published on 2025-03-11, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw enables an unauthorized attacker to execute arbitrary code locally within the affected WSL component.

A local attacker can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing full code execution in the context of WSL.

Microsoft's update guide provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24084.

EU & UK References

Vulnerability details

Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.

CWE(s)
CWE-822

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Local untrusted pointer dereference enabling arbitrary code execution with no privileges or user interaction required directly maps to exploitation for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-21232Same product: Microsoft Windows 11 23H2
CVE-2026-20811Same product: Microsoft Windows 11 23H2
CVE-2025-21358Same product: Microsoft Windows 11 22H2
CVE-2026-20857Same product: Microsoft Windows 11 23H2
CVE-2026-21250Same product: Microsoft Windows 11 24H2
CVE-2025-24990Same product: Microsoft Windows 11 22H2
CVE-2025-24076Same product: Microsoft Windows 11 22H2
CVE-2026-27920Same product: Microsoft Windows 11 23H2
CVE-2026-32077Same product: Microsoft Windows 11 23H2
CVE-2026-27919Same product: Microsoft Windows 11 23H2

Affected Assets

microsoft
windows 11 22h2
≤ 10.0.22621.5039
microsoft
windows 11 23h2
≤ 10.0.22631.5039
microsoft
windows 11 24h2
≤ 10.0.26100.3403 · ≤ 10.0.26100.3403
microsoft
windows server 2022
≤ 10.0.20348.3270
microsoft
windows server 2022 23h2
≤ 10.0.25398.1486
microsoft
windows server 2025
≤ 10.0.26100.3403

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
preventrecover

Requires timely identification, reporting, and correction of flaws like this untrusted pointer dereference in WSL through patching and security updates.

SI-16 Memory Protection good match
prevent

Implements memory protections such as ASLR and DEP to prevent arbitrary code execution from untrusted pointer dereferences.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables vulnerability scanning to identify this WSL untrusted pointer dereference flaw for prioritization and remediation.

References