Loading vulnerability…
An elevation of privilege vulnerability in the legacy Agere Modem driver shipped natively with supported Windows operating systems. The flaw affects the ltmdm64.sys driver and has been described as involving dereference of an untrusted pointer during driver handling, with some reporting also associating the affected driver family with unsafe IOCTL handling. Successful exploitation allows a local attacker to elevate privileges on the affected system. The vulnerable driver may be present even on systems that do not actively use Agere modem hardware, expanding exposure across supported Windows installations. Microsoft addressed the issue by removing the obsolete driver from Windows in the October 2025 cumulative update rather than issuing a conventional code fix.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a full exploit for a vulnerability (CVE-2025-24990) in the Agere Modem Driver (ltmdm64.sys) on Windows. The exploit leverages insecure IOCTL handling (METHOD_NEITHER) to achieve arbitrary kernel memory read/write, which is then used to modify the Protection Level (PPL) of any process, effectively enabling or disabling process protection. The exploit supports both a 'data-only' technique and a more stable 'ioring' technique for Windows 11 22H2+. The codebase is organized into two main exploit paths: - src_data_only: Implements the exploit using direct IOCTL manipulation and data-only primitives for arbitrary read/write. - src_ioring: Implements the exploit using the ioring kernel feature for more stable arbitrary read/write on newer Windows versions. The main entry points are 'src_data_only/demo.cpp' and 'src_ioring/main.cpp', which take a target PID and desired protection level as arguments. The exploit requires the vulnerable driver to be loaded manually and, on some systems, SeDebugPrivilege to leak kernel addresses. The exploit is operational and provides a reliable local privilege escalation path on affected systems.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in the ltmdm64.sys Agere Modem driver caused by insecure IOCTL handling leading to null pointer dereference, arbitrary command execution, or system crash.
An elevation of privilege vulnerability in the Windows Agere Modem Driver reported as exploited and included in CISA KEV.
An in-the-wild exploited local privilege escalation vulnerability in the Agere Modem driver ltmdm64.sys enabling administrative privilege gain.
A high-severity Windows native driver vulnerability affecting Agere Modem devices that enables privilege escalation to administrator level.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.