CVE-2025-24993: Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability

What it is

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Exploitation evidence

First exploit evidence seen: 2025-03-11 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2025-03-11. Source

Sources: CISA KEV.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

• microsoft windows 10 1507: upgrade to 10.0.10240.20947 or later
• microsoft windows 10 1607: upgrade to 10.0.14393.7876 or later
• microsoft windows 10 1809: upgrade to 10.0.17763.7009 or later
• microsoft windows 10 21h2: upgrade to 10.0.19044.5608 or later
• microsoft windows 10 22h2: upgrade to 10.0.19045.5608 or later
• microsoft windows 11 22h2: upgrade to 10.0.22621.5039 or later
• microsoft windows 11 23h2: upgrade to 10.0.22631.5039 or later
• microsoft windows 11 24h2: upgrade to 10.0.26100.3403 or later
• microsoft windows server 2016: upgrade to 10.0.14393.7876 or later
• microsoft windows server 2019: upgrade to 10.0.17763.7009 or later
• microsoft windows server 2022: upgrade to 10.0.20348.3270 or later
• microsoft windows server 2022 23h2: upgrade to 10.0.25398.1486 or later
• microsoft windows server 2025: upgrade to 10.0.26100.3403 or later

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24993 (CISA KEV notes)
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993 (Vendor Advisory)

MITRE ATT&CK mitigations for this chain

• M1017 User Training (for T1204) : Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.
• M1038 Execution Prevention (for T1204, T1068) : Application control may be able to prevent the running of executables masquerading as other files.
• M1040 Behavior Prevention on Endpoint (for T1204, T1055) : On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent executable files from running unless they meet a prevalence, age, or trusted list criteria and to prevent Office applications from creating potentially malicious executable content by blocking malicious code from being written to disk. Note: cloud-de
• M1021 Restrict Web-Based Content (for T1204) : If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats
• M1031 Network Intrusion Prevention (for T1204) : If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
• M1033 Limit Software Installation (for T1204) : Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.
• M1050 Exploit Protection (for T1203, T1068) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploi
• M1051 Update Software (for T1203, T1068) : Perform regular software updates to mitigate exploitation risk. Keeping software up-to-date with the latest security patches helps prevent adversaries from exploiting known vulnerabilities in client software, reducing the risk of successful attacks.
• M1048 Application Isolation and Sandboxing (for T1203, T1068) : Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist.
• M1019 Threat Intelligence Program (for T1068) : Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.

Detection Generic guidance

• Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
• Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.
• Impact: Monitor service availability, unexpected encryption activity and mass file changes.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.