Skip to main content

CVE-2025-24992: CWE-126: Buffer Over-read in Microsoft Windows 10 Version 1809

Medium
VulnerabilityCVE-2025-24992cvecve-2025-24992cwe-126
Published: Tue Mar 11 2025 (03/11/2025, 16:59:19 UTC)
Source: CVE
Vendor/Project: Microsoft
Product: Windows 10 Version 1809

Description

Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.

AI-Powered Analysis

AILast updated: 06/11/2025, 01:46:20 UTC

Technical Analysis

CVE-2025-24992 is a medium-severity vulnerability identified as a buffer over-read (CWE-126) in the Microsoft Windows 10 operating system, specifically version 1809 (build 10.0.17763.0). The flaw exists within the Windows NTFS file system driver, where improper bounds checking leads to a buffer over-read condition. This vulnerability allows an unauthorized local attacker to read sensitive information from memory that should not be accessible, potentially disclosing confidential data. Exploitation requires local access and some user interaction, such as opening a specially crafted file or triggering a specific NTFS operation. The vulnerability does not require privileges (PR:N) but does require user interaction (UI:R). The attack vector is local (AV:L), meaning remote exploitation is not feasible without prior access. The vulnerability impacts confidentiality (C:H) but does not affect integrity or availability. No known exploits are currently in the wild, and no patches have been linked yet. The CVSS 3.1 base score is 5.5, reflecting a medium severity level. The vulnerability was reserved in late January 2025 and published in March 2025. Given the nature of NTFS as the default file system for Windows, this vulnerability affects all systems running the specified Windows 10 version with NTFS enabled. The flaw could be leveraged to disclose sensitive information from kernel memory or other protected areas, which might include credentials, encryption keys, or other critical data, depending on the memory layout and system state at the time of exploitation.

Potential Impact

For European organizations, the impact of CVE-2025-24992 primarily concerns confidentiality breaches on affected Windows 10 Version 1809 systems. Many enterprises and public sector entities in Europe still operate legacy Windows 10 versions due to compatibility or operational constraints, making them susceptible. Disclosure of sensitive information could lead to further targeted attacks, such as privilege escalation or lateral movement, especially if attackers obtain credentials or cryptographic material. Although the vulnerability requires local access and user interaction, insider threats or malware with limited privileges could exploit this flaw to harvest sensitive data. This risk is particularly significant for sectors handling sensitive personal data (e.g., healthcare, finance, government) under strict EU data protection regulations (GDPR). The vulnerability does not affect system integrity or availability directly, so disruption of services is unlikely. However, the potential for data leakage could result in regulatory penalties, reputational damage, and increased incident response costs. Organizations relying on Windows 10 Version 1809 in critical infrastructure or industrial control systems should also consider the risk of information disclosure aiding more complex attacks.

Mitigation Recommendations

1. Upgrade or patch: Although no patch links are provided yet, organizations should prioritize upgrading affected systems from Windows 10 Version 1809 to a supported, patched version of Windows 10 or Windows 11 as soon as updates become available. 2. Restrict local access: Limit user permissions and restrict physical and remote local access to systems running the vulnerable version to trusted personnel only. 3. User awareness: Educate users about the risks of opening untrusted files or executing unknown operations that may trigger the vulnerability. 4. Application whitelisting: Implement application control policies to prevent execution of unauthorized or suspicious code that could exploit this vulnerability. 5. Endpoint detection and response (EDR): Deploy EDR solutions capable of detecting anomalous local file system access or suspicious user interactions that might indicate exploitation attempts. 6. Network segmentation: Isolate legacy systems to reduce the risk of lateral movement if an attacker gains local access. 7. Monitor logs: Regularly review system and security logs for unusual NTFS activity or user behavior that could signal exploitation attempts. 8. Incident response readiness: Prepare response plans specifically addressing local privilege escalation or information disclosure scenarios involving NTFS vulnerabilities.

Need more detailed analysis?Get Pro

Technical Details

Data Version
5.1
Assigner Short Name
microsoft
Date Reserved
2025-01-30T15:14:20.992Z
Cisa Enriched
true
Cvss Version
3.1
State
PUBLISHED

Threat ID: 682cd0f81484d88663aeb376

Added to database: 5/20/2025, 6:59:04 PM

Last enriched: 6/11/2025, 1:46:20 AM

Last updated: 7/8/2025, 9:22:10 PM

Views: 8

Actions

PRO

Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.

Please log in to the Console to use AI analysis features.

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats