CVE-2025-24991 Overview
CVE-2025-24991 is an out-of-bounds read vulnerability in the Windows NTFS file system driver. The flaw allows an authorized local attacker to read memory outside of allocated buffer boundaries, resulting in information disclosure. Exploitation requires user interaction, typically the mounting or opening of a maliciously crafted virtual hard disk (VHD) file. The vulnerability affects a broad range of Windows client and server releases, from Windows Server 2008 through Windows 11 24H2 and Windows Server 2025. CISA added CVE-2025-24991 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
Critical Impact
An authorized local attacker can disclose sensitive kernel or process memory by tricking a user into mounting a crafted NTFS volume, exposing data that may aid further attacks on the host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-03-11 - CVE-2025-24991 published to NVD and addressed in the Microsoft March 2025 Patch Tuesday release
- 2025-10-27 - Last updated in NVD database
Technical Details for CVE-2025-24991
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in the Windows NTFS driver (ntfs.sys). When NTFS parses metadata structures from a specially crafted file system image, it fails to validate the bounds of certain fields before dereferencing them. The driver reads memory adjacent to the intended buffer, returning uninitialized or unrelated kernel data to the attacker-controlled context.
Because NTFS parsing executes in kernel mode, leaked bytes can include pointers, allocation metadata, or other process data useful for bypassing Kernel Address Space Layout Randomization (KASLR). Attackers commonly chain such leaks with separate memory-corruption flaws to achieve reliable privilege escalation.
Root Cause
The root cause is missing or insufficient boundary validation when the NTFS driver reads structured metadata from a mounted volume. A field whose value should be constrained by the on-disk layout is trusted by the parser, causing reads past the end of the allocated structure. The defect aligns with CWE-125 (Out-of-bounds Read).
Attack Vector
Exploitation requires local access and user interaction. An attacker delivers a malicious VHD or VHDX file through phishing, removable media, or a downloaded archive. When the user double-clicks or otherwise mounts the image, Windows auto-mounts the volume and the vulnerable NTFS parser processes the crafted structures. The attacker can read the leaked memory through follow-on file-system queries returned by the driver. No elevated privileges are required to deliver the file, but the user must perform the mount action.
A verified exploitation code example is not available for this advisory. See the Microsoft Security Update Guide for CVE-2025-24991 for vendor technical details.
Detection Methods for CVE-2025-24991
Indicators of Compromise
- Unexpected .vhd or .vhdx files delivered via email attachments, archives, or web downloads, followed by mount activity.
- Mount events for virtual disks from non-standard user directories such as %TEMP%, Downloads, or Desktop.
- Kernel crashes or ntfs.sys faults logged in the System event log shortly after a VHD mount.
Detection Strategies
- Monitor Microsoft-Windows-VHDMP-Operational and Microsoft-Windows-Ntfs/Operational event channels for mount operations originating from user-writable locations.
- Alert on process chains where explorer.exe or a mail client triggers vhdmp.sys mount activity for newly written disk images.
- Correlate Sysmon FileCreate events for VHD/VHDX extensions with subsequent volume mount and file enumeration activity.
Monitoring Recommendations
- Track creation and access of virtual disk files across endpoints and forward telemetry to a centralized analytics platform.
- Baseline legitimate administrative VHD usage to suppress noise and highlight anomalous mounts by standard users.
- Review CISA KEV updates regularly and prioritize hunting on hosts that processed VHD files prior to patch deployment.
How to Mitigate CVE-2025-24991
Immediate Actions Required
- Apply the March 2025 Microsoft security updates to all affected Windows client and server systems without delay, given CISA KEV listing.
- Inventory endpoints that have processed VHD or VHDX files and prioritize them for patching and review.
- Block inbound delivery of .vhd and .vhdx attachments at email gateways and web proxies where business use does not require them.
Patch Information
Microsoft released fixes through the March 2025 Patch Tuesday cycle. Refer to the Microsoft Security Update Guide for CVE-2025-24991 for the specific KB articles applicable to each Windows version. The patch is also tracked in the CISA Known Exploited Vulnerabilities Catalog.
Workarounds
- Restrict the ability for standard users to mount virtual hard disks by removing the SeManageVolumePrivilege from non-administrative accounts where feasible.
- Use Group Policy or AppLocker to block execution and mounting of VHD/VHDX files originating from user-writable directories.
- Train users to avoid opening unsolicited disk image files and verify the source of any virtual disks received externally.
# Example: block VHD/VHDX file mounts via File Screen on a Windows file server
New-FsrmFileGroup -Name "BlockedDiskImages" -IncludePattern @("*.vhd","*.vhdx")
New-FsrmFileScreen -Path "C:\Users" -IncludeGroup "BlockedDiskImages" -Active
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
