CVE-2025-24984: medium-severity vulnerability in Microsoft Windows 10 Version 1507
Windows NTFS Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Windows NTFS stores sensitive information in log files that an attacker with physical access to the computer can read. This leaks private data that should be protected.
CWE-532 vulnerability where sensitive data is written to NTFS log files accessible via physical attack. An attacker with local disk access can extract confidential information from these logs, potentially compromising authentication credentials or system secrets. Requires physical presence or direct storage device access.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.