CVE-2025-24991: 
vulnerability analysis and mitigation

Microsoft Windows NTFS contains an out-of-bounds read vulnerability (CVE-2025-24991) discovered in March 2025. This vulnerability affects Windows NTFS (New Technology File System) and allows an authorized attacker to disclose information locally. The vulnerability was reported by Microsoft Corporation and has been added to CISA's Known Exploited Vulnerabilities Catalog (CISA Alert, NVD).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) in the Windows NTFS component. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires local access, low attack complexity, no privileges, and user interaction, while potentially resulting in high confidentiality impact (NVD).

When successfully exploited, this vulnerability allows an authorized attacker to disclose information locally. The attack primarily affects the confidentiality of the system, with no direct impact on integrity or availability (Microsoft Advisory).

The vulnerability requires local access and user interaction for successful exploitation. As of the disclosure date, there are no reports of this vulnerability being exploited in the wild (CISA KEV).

CISA has established a due date of April 1, 2025, for federal agencies to apply vendor-provided mitigations. Organizations are advised to apply mitigations according to vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable (CISA KEV).