CVE-2025-24984
KEVMicrosoft Windows NTFS Information Disclosure Vulnerability
Description
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
CVSS 3.1 vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NPublishedMar 11, 2025
Last modifiedJun 17, 2026
Added to KEVMar 11, 2025
Remediation dueApr 1, 2025
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984PatchVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984US Government Resource
0 recent articles mention this CVE
53
Risk assessment · Medium
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 574 days
- CVSS
- 4.6 MEDIUM
- EPSS (30-day exploit probability)
- 2.0% · top 19% of all CVEs
- Weakness
- CWE-532
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.