CVE-2024-24993 is a zero-day heap-based buffer overflow vulnerability in the Windows NTFS file system. It was actively exploited in the wild in early 2025 and allows attackers to execute arbitrary code locally.
CVE-2024-24993 was exploited by attackers by tricking users into mounting a specially crafted virtual hard disk. Successful exploitation allowed the attacker to execute arbitrary code locally, potentially leading to full system compromise.
This vulnerability was considered a high-priority update due to its potential for local privilege escalation and its use in targeted attacks.
Microsoft released security updates for this vulnerability in March 2025 as part of Patch Tuesday. Users and administrators are strongly advised to apply the update immediately to prevent exploitation.
For systems that cannot be patched, Microsoft recommends restricting access to virtual hard disk mounting and monitoring for suspicious activity.