Skip to content
Log inStart free trial

CVE-2025-24993

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

High Known exploited
Severity
7.8 / 10
High · CVSS 3.1
Exploit chance (EPSS)
2.22%
Chance of exploitation in the next 30 days. Higher than 82.64% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Mar 11, 2025
Weakness
CWE-122 Heap-based Buffer Overflow
Fix
None yet
No fixed version published
Exploited in the wild. Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability (Microsoft Windows). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Apr 1, 2025.

Description

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-122: Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

How to prevent it
  • Pre-design: Use a language or compiler that performs automatic bounds checking.
  • Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Operation, Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
  • Operation, Build and Compilation: Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking. For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
  • Implementation: Implement and perform bounds checking on input.
  • Implementation: Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
  • Operation: Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.

References

Advisories

Other links

Timeline

  1. Added to CISA's Known Exploited Vulnerabilities catalog
  2. Published
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-8g5g-8vmr-9782
Pillow: Heap buffer overflow in ImagingJpegDecode
Critical Same weakness, CWE-122
GHSA-5x8w-8jj5-q52h
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Critical Same weakness, CWE-122
GHSA-462x-pgg6-55fp
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
High Same weakness, CWE-122
GHSA-332p-7hrc-92wf
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Critical Same weakness, CWE-122
CVE-2026-94127
When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE).
Critical Known exploited Same weakness, CWE-122
GHSA-rgj7-g3m4-5g8c
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
High Same weakness, CWE-122
CVE-2026-85880
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
High Known exploited Same weakness, CWE-122
GHSA-jqhp-238x-qhgf
Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability
High Same weakness, CWE-122
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor