CVE-2025-24993

What it actually does

This is a heap-based buffer overflow in the Windows NTFS file system driver. A crafted NTFS volume or NTFS file-system metadata can corrupt kernel memory when parsed by Windows, allowing a local, unauthorized attacker to execute code on the affected system. Because NTFS parsing occurs in privileged operating-system components, successful exploitation can result in code execution with high integrity or kernel-level privileges, depending on the exploit path and target configuration.

Why it matters to the business

Successful exploitation can allow an attacker who can convince a user or system to process a malicious NTFS-formatted disk image, removable drive, or volume to take control of the Windows endpoint. This can lead to malware execution, credential theft, lateral movement, endpoint tampering, and operational disruption. The vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2025-04-01, so patching should be treated as urgent even though the EPSS score is relatively low.

How an attack unfolds

An attacker prepares malicious NTFS file-system structures designed to trigger a heap overflow in Windows NTFS parsing code. The malicious content may be delivered as removable media, a mounted disk image, or another workflow that causes Windows to read the crafted NTFS volume. When the victim system mounts, scans, indexes, or otherwise parses the crafted NTFS data, memory corruption occurs inside privileged Windows file-system handling code. A reliable exploit can redirect execution to attacker-controlled code, enabling local code execution and potentially privilege escalation. After code execution, the attacker typically deploys a payload, establishes persistence, disables defenses, collects credentials, or pivots to other systems.

How to fix it

Apply the Microsoft security update that fixes CVE-2025-24993 on all affected Windows systems. Because no product-specific fixed versions were provided in the input, use the applicable Microsoft cumulative update or security-only update for each supported Windows version, prioritizing endpoints, VDI images, jump hosts, file servers, and systems that process removable media or disk images. Where immediate patching is not possible, reduce exposure by restricting mounting of untrusted disk images and removable media, disabling AutoPlay/AutoRun, enforcing least privilege, blocking untrusted VHD/VHDX/ISO workflows where feasible, and using endpoint controls to prevent suspicious child processes from disk-mounting utilities and Explorer.

How to confirm the fix worked

Confirm that the relevant Microsoft security update from March 2025 or later, or the vendor-designated superseding cumulative update, is installed on every in-scope Windows system. Validate through centralized patch management, Windows Update history, endpoint inventory, or PowerShell-based hotfix/compliance checks. Confirm that ntfs.sys and related Windows file-system components are at patched build levels for the installed OS version. Test policy controls by verifying that untrusted removable media and disk image mounting are blocked or monitored where required. Re-scan with vulnerability management tools after patch deployment and ensure the finding is no longer reported.

Typical attack path

1. Prepare a malicious NTFS-formatted volume, disk image, or removable-media artifact containing crafted file-system metadata.
2. Deliver the artifact to a target user or endpoint through removable media, download, email attachment, shared storage, or another file-transfer channel.
3. Cause Windows to mount, scan, preview, index, or otherwise parse the crafted NTFS content.
4. Trigger heap memory corruption in the Windows NTFS driver.
5. Execute attacker-controlled code locally with elevated privileges or in a privileged OS context.
6. Deploy follow-on tooling such as credential theft, persistence, command execution, defense evasion, or lateral-movement payloads.

How to detect it

To determine whether exploitation may have occurred, review endpoint and Windows telemetry around the time users accessed removable media or mounted disk images. Key sources include Windows Security event logs for process creation, PowerShell logs, Sysmon or EDR telemetry, System event logs for NTFS, disk, VHD, and crash events, Windows Error Reporting, Defender/AV alerts, Prefetch, Amcache, ShimCache, RecentDocs, ShellBags, mounted-device artifacts, and removable-storage history. Look for a sequence where a VHD/VHDX/ISO/IMG/removable device is mounted, followed by NTFS errors, heap-corruption crashes, unexpected privileged process execution, suspicious child processes from explorer.exe or PowerShell, new services or scheduled tasks, credential-access tooling, or unsigned binaries written to user-writable directories. Also search for bugchecks or crash reports referencing ntfs.sys, abnormal use of mountvol.exe, diskpart.exe, or PowerShell Mount-DiskImage, and EDR alerts indicating memory corruption, exploit behavior, or local privilege escalation soon after media access. There are no universal public file hashes or network indicators for this vulnerability, so detection should focus on behavioral correlation and host artifacts.

• ntfs.sys
• Mount-DiskImage
• mountvol.exe
• diskpart.exe
• vhdmp.sys
• Microsoft-Windows-Ntfs
• Microsoft-Windows-VHDMP
• BugCheck
• STATUS_HEAP_CORRUPTION
• 0xc0000374
• .vhd
• .vhdx
• .img
• .iso
• explorer.exe -> powershell.exe
• explorer.exe -> cmd.exe
• explorer.exe -> wscript.exe
• explorer.exe -> rundll32.exe
• Event ID 4688
• Event ID 1001
• Event ID 55
• Event ID 98

What your security team should do

• Patch all affected Windows systems immediately, prioritizing internet-exposed workstations, high-value administrator workstations, file servers, VDI/golden images, and systems that commonly handle removable media or disk images.
• Treat this as high priority because it is in CISA KEV and has active exploitation in the wild, regardless of the lower EPSS score.
• Hunt for recent mounting of unusual VHD, VHDX, ISO, IMG, or removable NTFS media followed by crashes, privilege escalation behavior, suspicious process creation, or endpoint security alerts.
• Temporarily restrict or monitor use of disk-mounting utilities such as Mount-DiskImage, diskpart, mountvol, PowerShell, and Explorer-driven mounting from user-writable paths.
• Disable AutoPlay/AutoRun and enforce controls for removable media, especially on administrative endpoints and sensitive networks.
• Review EDR telemetry for suspicious child processes launched after removable media or disk-image access, including command shells, PowerShell, script interpreters, credential tools, or unsigned binaries.
• Ensure backups and recovery processes are healthy in case exploitation was used as part of destructive activity, even though this KEV entry is not specifically marked as ransomware-associated.