CVE-2025-24991
Published: 11 March 2025
Summary
CVE-2025-24991 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 17.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24991 is an out-of-bounds read vulnerability (CWE-125) in the Windows NTFS file system. It affects Windows operating systems that utilize NTFS and was published on 2025-03-11 with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
The vulnerability can be exploited by a local attacker requiring no privileges, though user interaction is necessary and attack complexity is low. Successful exploitation allows the attacker to disclose sensitive information locally with high confidentiality impact, without affecting integrity or availability.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991 provides details on the vulnerability and mitigation recommendations, including available patches. It is also listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24991, indicating active exploitation in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6320
Vulnerability details
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
- CWE(s)
- KEV Date Added
- 11 March 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The out-of-bounds read in NTFS directly enables local disclosure of sensitive information from the system, mapping to Data from Local System.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the out-of-bounds read flaw in Windows NTFS through application of Microsoft patches.
Requires scanning for CVE-2025-24991 vulnerabilities in Windows systems to identify and prioritize patching needs.
Ensures organizations obtain and act on security advisories from Microsoft MSRC and CISA KEV catalog for this actively exploited vulnerability.