Exploited vulnerability

CVE-2025-24984

TLP:CLEAR

Microsoft Windows NTFS Information Disclosure Vulnerability

Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.

Facts

Vendor: Microsoft
Product: Windows
CVSS: 4.6
EPSS (probability of exploitation within 30 days): 2 %
On CISA's Known Exploited Vulnerabilities list since: 11 March 2025
First known exploitation: 11 March 2025
CISA's deadline for US federal agencies: 1 April 2025
Weakness: CWE-532
First seen by Risk Letters: 11 March 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD