⚠ Actively exploited
Added to CISA KEV on 2025-03-11. Federal agencies required to patch by 2025-04-01. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2025-24984 — Log File Information Exposure in Microsoft Windows 10 Version 1507

CWE-532 — Log File Information Exposure16 documents12 sources
Severity
4.6MEDIUMNVD
EPSS
4.4%
top 10.92%
CISA KEV
KEV
Added 2025-03-11
Due 2025-04-01
Exploit
No known exploits
Affected products
24
Microsoft Windows 10 Version 1507Microsoft Windows 10 Version 1607Microsoft Windows 10 Version 1809+21 more
Timeline
PublishedMar 11
KEV addedMar 11
Latest updateMar 12
KEV dueApr 1
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 0.9 | Impact: 3.6

Affected Packages24 packages

▶NVDmicrosoft/windows< 10.0.14393.7876+5
▶NVDmicrosoft/windows_10_1507< 10.0.10240.20947
▶NVDmicrosoft/windows_10_1607< 10.0.14393.7876
▶NVDmicrosoft/windows_10_1809< 10.0.17763.7009
▶NVDmicrosoft/windows_10_21h2< 10.0.19044.5608

Patches

Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-2q4f-gjpq-vfmh: Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack↗2025-03-11
▶
CVEList
Windows NTFS Information Disclosure Vulnerability↗2025-03-11
▶
VulnCheck
Microsoft Windows NTFS Information Disclosure Vulnerability↗2025
▶

📋Vendor Advisories

2
CISA
Microsoft Windows NTFS Information Disclosure Vulnerability↗2025-03-11
▶
Microsoft
Windows NTFS Information Disclosure Vulnerability↗2025-03-11
▶

🕵️Threat Intelligence

10
Bleepingcomputer
Microsoft patches Windows Kernel zero-day exploited since 2023↗2025-03-12
▶
Krebs
Microsoft: 6 Zero-Days in March 2025 Patch Tuesday↗2025-03-12
▶
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review↗2025-03-11
▶
Talos
Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities↗2025-03-11
▶
Tenable
Microsoft’s March 2025 Patch Tuesday Addresses 56 CVEs (CVE-2025-26633, CVE-2025-24983, CVE-2025-24993)↗2025-03-11
▶
CVE-2025-24984 — Log File Information Exposure | cvebase