CVE-2025-24984: Windows 10 1507 Information Disclosure Flaw

CVE-2025-24984 Overview

CVE-2025-24984 is an information disclosure vulnerability in Windows NTFS that allows an unauthorized attacker with physical access to disclose sensitive information. The vulnerability stems from the improper handling of sensitive data, which is inadvertently written to log files within the NTFS file system. This flaw, classified as CWE-532 (Insertion of Sensitive Information into Log File), can be exploited by attackers who gain physical access to a vulnerable system, potentially exposing confidential data stored in NTFS logs.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations with unpatched Windows systems are at risk of sensitive data exposure through physical access attacks.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• March 11, 2025 - CVE-2025-24984 published to NVD
• October 27, 2025 - Last updated in NVD database

Technical Details for CVE-2025-24984

Vulnerability Analysis

The vulnerability exists within the Windows NTFS file system driver, where sensitive information is improperly logged during certain file system operations. NTFS maintains various log files for journaling and recovery purposes, including the USN (Update Sequence Number) journal and the $LogFile metadata file. Under specific conditions, the NTFS driver writes sensitive data to these log files without proper sanitization, creating an avenue for information disclosure.

An attacker with physical access to a system—such as through a stolen laptop, removed hard drive, or during a boot from external media—can extract these log files and analyze their contents to retrieve sensitive information. This could include remnants of file operations, deleted file names, partial file contents, or other metadata that should have been protected.

The vulnerability requires physical access to exploit, which limits the attack surface but makes it particularly concerning for enterprise environments where device theft or insider threats are considerations. Once physical access is obtained, no additional authentication is required to extract the vulnerable log data.

Root Cause

The root cause is CWE-532: Insertion of Sensitive Information into Log File. The NTFS driver fails to properly sanitize or exclude sensitive information before writing to internal log files. This represents a design flaw where debugging, journaling, or recovery mechanisms inadvertently capture and persist data that should be treated as confidential. The sensitive information remains in log files even after the original data may have been deleted or modified, creating a persistent exposure window.

Attack Vector

The attack requires physical access to the target system. An attacker can exploit this vulnerability through several scenarios:

The attack vector requires physical proximity to the target machine. An attacker could boot the system from external media (such as a Linux live USB) to access the NTFS partition without Windows authentication controls. Alternatively, the hard drive could be removed and connected to another system for analysis. Once the attacker has raw access to the NTFS volume, they can extract the $LogFile, USN journal, or other NTFS metadata files using forensic tools. By parsing these log files, the attacker can recover sensitive information that was inadvertently logged by the vulnerable NTFS driver.

Detection Methods for CVE-2025-24984

Indicators of Compromise

• Unexpected access to NTFS system metadata files such as $LogFile, $UsnJrnl, or $MFT from non-standard processes or boot environments
• Evidence of system boot from external media or unauthorized physical access to devices
• Forensic artifacts indicating extraction of NTFS log files or journal data
• Unusual file system activity involving NTFS internal files outside of normal Windows operations

Detection Strategies

• Monitor for physical security incidents including device theft, unauthorized access to server rooms, or evidence of drive removal
• Implement endpoint detection rules to identify attempts to access raw NTFS metadata files from user-mode processes
• Deploy full-disk encryption (BitLocker) monitoring to ensure encryption remains active on all protected volumes
• Review system event logs for unexpected shutdown events or boot sequence anomalies that could indicate external media boot attempts

Monitoring Recommendations

• Enable and monitor physical security controls including access logs for data centers and secure areas
• Implement TPM-based attestation to detect unauthorized boot configurations
• Configure SentinelOne agents to alert on suspicious file system access patterns targeting NTFS metadata
• Establish baseline behavior for NTFS log file access and alert on deviations

How to Mitigate CVE-2025-24984

Immediate Actions Required

• Apply Microsoft security updates released in March 2025 to all affected Windows systems immediately
• Enable BitLocker full-disk encryption on all Windows systems to protect data at rest from physical access attacks
• Implement strong physical security controls for all endpoints and servers running affected Windows versions
• Prioritize patching for systems with higher physical access risk, including laptops, workstations in public areas, and portable devices

Patch Information

Microsoft has released security updates addressing this vulnerability as part of their March 2025 Patch Tuesday release. Organizations should consult the Microsoft Security Response Center advisory for CVE-2025-24984 for specific patch details and version information. Given the active exploitation status and inclusion in the CISA Known Exploited Vulnerabilities catalog, federal agencies and critical infrastructure organizations are mandated to apply patches within specified timeframes.

Workarounds

• Enable BitLocker or equivalent full-disk encryption with TPM protection to prevent offline access to NTFS data
• Implement Secure Boot and disable boot from external media in BIOS/UEFI settings
• Physically secure all systems and restrict physical access to authorized personnel only
• For high-security environments, consider hardware security features such as tamper-evident cases and intrusion detection

# Enable BitLocker encryption on C: drive (run as Administrator)
manage-bde -on C: -RecoveryPassword

# Verify BitLocker status
manage-bde -status C:

# Check if Secure Boot is enabled
Confirm-SecureBootUEFI