CVE-2025-24990

CVE-2025-24990 is an untrusted pointer dereference (CWE-822) in the third-party Agere modem driver (ltmdm64.sys) that Microsoft ships natively with supported Windows client and server operating systems. Exploitation requires local access with limited privileges, and successful attacks yield high impact to the system's confidentiality, integrity, and availability (CVSS 3.1 7.8), a scoring pattern consistent with local privilege escalation. Because the driver is present by default, every supported Windows 10 build, Windows 11 build, and Windows Server 2008/2012/2016 installation listed by Microsoft is affected until patched. The flaw is being actively exploited in the wild — it was added to CISA's KEV on 2025-10-14 — although no public proof-of-concept is known. Microsoft remediated it in the October 2025 cumulative updates by removing ltmdm64.sys entirely, which means fax modem hardware that depends on this driver will stop working after patching.

What to do: Apply the October 2025 (or later) Windows cumulative update, which remediates the flaw by removing ltmdm64.sys, and prioritize systems where untrusted or low-privileged users can run code (RDS/VDI hosts, shared workstations, jump servers). After patching, check for Agere-based fax modem dependencies tied to ltmdm64.sys, as that hardware will no longer function and will need replacement or an alternative. Federal agencies must apply mitigations per vendor instructions or follow BOD 22-01 timelines for cloud services.