Loading vulnerability…
Windows NTFS Out-of-Bounds Read Information Disclosure
CVE-2025-24991 is an out-of-bounds read vulnerability in Windows NTFS, identified in the ReadRestartTable() function. Mounting a specially crafted virtual hard disk (VHD) can trigger the flaw, allowing an authorized attacker to disclose information locally, including small portions of heap memory. The vulnerability was actively exploited before its remediation in Microsoft's March 2025 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose small portions of heap memory and potentially sensitive information on the affected Windows system.
If you can’t patch tonight, do this now.
Avoid mounting VHDs from untrusted sources. This reduces exposure to the documented attack vector but does not replace patching. An official workaround is not identified.
Patch, then assume compromise.
Apply the applicable Microsoft security updates addressing CVE-2025-24991, released in March 2025. Specific update package identifiers and fixed versions are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.