Windows NTFS Information Disclosure Vulnerability
CVE-2025-24991 is an information disclosure vulnerability in Windows NTFS (rated Important, CVSS 5.5). Microsoft reports that it is being exploited.
Exploited1 version
Facts
- Microsoft id
CVE-2025-24991- Status
- Exploited
- Products
- Windows NTFS
- Severity
- Important
- Impact
- Information Disclosure
- CVSS
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C
- Exploited
- Yes
- Publicly disclosed
- No
- Exploitability
- Exploitation Detected
- Customer action required
- Yes
- Release
- 2025-Mar
- Assigned by
- Microsoft
- Weakness
- CWE-125: Out-of-bounds Read
- MSRC revision
- 1.0
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-03-11:
Information published.
Microsoft says
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. What type of information could be disclosed by this vulnerability?
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
As first seen: Exploited
- Status
- Exploited
Seen by us · Microsoft's timestamp · Microsoft's page