CVE-2025-24991: medium-severity vulnerability in Microsoft Windows 10 Version 1507
Windows NTFS Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Windows NTFS allows someone with local access to read data beyond the intended boundaries of a file system structure, potentially exposing sensitive information stored on the system.
An out-of-bounds read vulnerability in the NTFS driver permits authenticated local attackers to access memory regions outside legitimate file system metadata boundaries, enabling information disclosure. The attack requires prior system access and results in unauthorized exposure of sensitive kernel or file system data.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.