CVE-2025-24984: Windows NTFS logs sensitive information, enabling physical-attack disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

medium priorityCVSS is only 4.6 and the vector requires physical access, but CISA KEV listing means it is known-exploited and a patch deadline applies.

What it is

Windows NTFS writes sensitive information into a log file, which an attacker can read to disclose data. The flaw is rated CVSS 3.1 4.6 (Medium) and affects a broad set of Windows 10, Windows 11 and Windows Server releases. It matters because the affected code is present across nearly all supported Windows versions, though exploitation requires physical access to the machine.

Impact

An attacker who can reach the machine physically gains disclosure of sensitive information written to the NTFS log; there is no integrity or availability impact. The confidentiality impact is rated High, so the leaked data could be meaningful rather than trivial.

Attack surface

The CVSS vector is AV:P/AC:L/PR:N/UI:N, so the attack requires physical access to the target system, needs no authentication and no user interaction. It is not remotely reachable over a network.

Exploitation

CISA added it to the KEV catalog on 2025-03-11 with a remediation due date of 2025-04-01, indicating known exploitation, while EPSS puts 30-day exploitation probability at about 2.0 percent (79th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft update listed in the MSRC advisory for CVE-2025-24984 across all affected Windows 10, Windows 11 and Windows Server builds.
• Follow CISA BOD 22-01 guidance and meet the 2025-04-01 remediation due date, or discontinue use of the product if mitigations are unavailable.
• Restrict and monitor physical access to systems holding sensitive data, since the attack vector is physical.
• Verify patch coverage for the long list of affected builds, including older Windows 10 1507/1607/1809 and Windows Server 2012/2016, which are easy to miss.

Detection

• Review NTFS log and metadata artifacts on sensitive endpoints for unexpected or anomalous content that could indicate sensitive data written to disk.
• Audit physical access logs and console or USB activity on systems that store high-value data, correlating with any signs of NTFS log inspection.
• Track patch compliance for CVE-2025-24984 across all affected Windows builds and flag unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.