EXPOSURES › CVE-2025-24984
CVE-2025-24984
HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
⌖ EXPLOITED IN THE WILD
SHAME 50/100
exploited-in-wild
A physical attack on Microsoft Windows systems can expose heap memory via an NTFS information disclosure vulnerability currently being actively exploited by adversaries.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
PLAYERS IMPLICATED
DESCRIPTION
Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.
AFFECTED FEDRAMP PRODUCTS · 4
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |