CVE-2025-24990
Published: 14 October 2025
Summary
CVE-2025-24990 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 13.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates this vulnerability by applying the October cumulative update that removes the vulnerable ltmdm64.sys driver.
Monitoring security alerts and directives from MSRC and CISA KEV catalog ensures timely awareness and response to this actively exploited vulnerability.
Vulnerability scanning detects the presence of the vulnerable ltmdm64.sys driver on systems prior to remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables local low-privileged attackers to achieve privilege escalation via exploitation of the vulnerable driver (CWE-822), directly mapping to T1068: Exploitation for Privilege Escalation.
NVD Description
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative…
more
update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
Deeper analysisAI
CVE-2025-24990 affects the third-party Agere Modem driver, specifically ltmdm64.sys, which ships natively with supported Windows operating systems. This vulnerability, associated with CWE-822 (Untrusted Pointer Dereference), has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has announced the removal of the driver due to these issues, with the driver already excised in the October cumulative update.
A local attacker with low privileges can exploit the vulnerability through low-complexity means requiring no user interaction. Exploitation enables high-impact consequences on confidentiality, integrity, and availability, facilitating elevation of privilege on affected Windows systems.
Microsoft advisories state that the ltmdm64.sys driver has been removed via the October cumulative update, rendering dependent fax modem hardware non-functional on Windows. The company recommends eliminating any existing dependencies on this hardware. Additional guidance includes detection and mitigation scripts from Vicarius, with the vulnerability documented on MSRC and listed in CISA's Known Exploited Vulnerabilities Catalog.
The presence in CISA's KEV catalog indicates active real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 14 October 2025