CVE-2025-24991

CVE-2025-24991 is an out-of-bounds read vulnerability (CWE-125) in the Windows NTFS component, allowing a local, authorized attacker to read beyond allocated buffer boundaries. The flaw is triggered in a local attack scenario (AV:L) with user interaction required (UI:R), per the CVSS 3.1 vector. A successful exploit discloses sensitive information from affected memory (high confidentiality impact), with no integrity or availability impact and no privilege escalation or remote code execution. Affected systems span a broad set of supported releases: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008, 2012, 2016, and 2019. The vulnerability is actively exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-11 as one of six Microsoft Windows flaws added that week, and Microsoft addressed it in the March 2025 Patch Tuesday release of 57 fixes, including six actively exploited zero-days; EPSS currently estimates a 2.0% probability of exploitation in the next 30 days.

What to do: Apply Microsoft's March 2025 Patch Tuesday security updates to all affected Windows 10/11 client and Windows Server 2008/2012/2016/2019 systems, prioritizing internet-relevant and multi-user hosts given confirmed in-the-wild exploitation. Federal agencies must remediate per CISA KEV/BOD 22-01 timelines or remove the product from service if mitigations are unavailable. Because the flaw is exploitable by a local authorized user, review which local or low-privilege accounts can access exposed Windows hosts while patching completes.