microsoft windows-server-2012 CVE-2025-24984 vulnerability in Microsoft Products
Published on March 11, 2025

product logo product logo
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

Vendor Advisory NVD

Known Exploited Vulnerability

This Microsoft Windows NTFS Information Disclosure Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an authorized attacker to disclose information locally. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.

The following remediation steps are recommended / required by April 1, 2025: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2025-24984 is exploitable with physical access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 0.9 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.


Products Associated with CVE-2025-24984

You can be notified by stack.watch whenever vulnerabilities like CVE-2025-24984 are published in these products:

Microsoft Windows Server 2012
 
Microsoft Windows 10 1507
 
Microsoft Windows 10
 
Microsoft Windows 11
 
Microsoft Windows 11 23h2
 
Microsoft Windows 11 24h2
 
Microsoft Windows Server 2016
 
Microsoft Windows Server 2019
 
Microsoft Windows Server 2022
 
Microsoft Windows Server 2022 23h2
 
Microsoft Windows Server 2025
 

What versions are vulnerable to CVE-2025-24984?