CVE-2025-24061

—

CVSS 3.1

7.8 high

EPSS

1%p66

Published

Mar 11, 2025 (Mar 11, 2025)

Modified

Jun 17, 2026

Description

Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.

Vendors: microsoft
Products: windows 10 1507, windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 22h2, windows 11 23h2, windows 11 24h2, windows server 2016, windows server 2019, windows server 2022, windows server 2022 23h2
Weakness: CWE-693
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news3 stories

⚡ Weekly Recap: VPN Exploits, Oracle's Silent Breach, ClickFix Surge and More

The Hacker NewsMay 6, 07:05 UTC · May 6, 2025Data breach CVE-2025-22457 CVE-2025-24061 CVE-2025-2407+15 CVEs

60

The controversial case of the threat actor EncryptHub

Security AffairsApr 7, 13:14 UTC · Apr 7, 2025Threat actor CVE-2025-24061 CVE-2025-24071 CVE-2025-26633+1 CVEs

60

Microsoft Credits EncryptHub, Hacker Behind 618+ Breaches, for Disclosing Windows Flaws

The Hacker NewsApr 6, 09:08 UTC · Apr 6, 2025Exploit / PoC CVE-2025-24061 CVE-2025-24071 CVE-2025-26633

60