CVE-2025-24990: Windows Agere Modem driver untrusted pointer dereference EoP

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a local privilege escalation in a default Windows driver and is listed in CISA KEV as exploited in the wild, though it requires local low-privileged access and the driver has been removed by the October 2025 update.

What it is

The Agere Modem driver (ltmdm64.sys) shipped natively with supported Windows versions contains an untrusted pointer dereference (CWE-822) that allows elevation of privilege. Microsoft removed the driver in the October 2025 cumulative update and recommends eliminating dependencies on the affected fax modem hardware. The flaw matters because it is a local privilege escalation in a component present by default across a wide range of Windows client and server releases.

Impact

A local attacker who can execute code on a host can leverage the driver to escalate privileges, gaining high confidentiality, integrity and availability impact on the affected system.

Attack surface

The CVSS vector is AV:L/PR:L/UI:N, so the flaw is reached locally by an attacker who already holds low privileges on the machine; no user interaction is required. It is not remotely reachable and does not require the victim to open a file or click anything.

Exploitation

CVE-2025-24990 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2025-10-14, due 2025-11-04), indicating exploitation in the wild; EPSS gives a 30-day probability of roughly 6.4 percent (93rd percentile). No ransomware campaign use is documented.

What to do

• Apply the October 2025 Windows cumulative update, which removes the ltmdm64.sys driver.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance and vendor mitigations, or discontinue use of the affected product.
• Remove or disable any remaining ltmdm64.sys driver instances and eliminate dependencies on Agere fax modem hardware.
• Restrict local interactive and low-privileged code execution on endpoints to reduce the attack surface for local privilege escalation.
• Track the CISA KEV due date of 2025-11-04 and confirm remediation across all listed Windows client and server versions.

Detection

• Hunt for the presence of ltmdm64.sys on endpoints and verify it has been removed after the October 2025 update.
• Monitor for driver load events involving ltmdm64.sys, especially from non-standard or unexpected processes.
• Alert on local privilege escalation behavior following driver interaction, such as unexpected token or process privilege changes.
• Review EDR telemetry for exploitation attempts against the Agere modem driver on hosts with legacy fax modem hardware.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.