Executive brief
A security vulnerability exists in a modem driver that is included by default in most versions of Microsoft Windows. This flaw allows an attacker who already has basic access to a computer to gain full administrator control, potentially leading to data theft or the installation of persistent malware. Microsoft has addressed this by completely removing the affected driver in recent security updates, which may cause older fax modem hardware to stop functioning.
Technical details
An untrusted pointer dereference vulnerability (CWE-822) exists in the Agere Modem driver (ltmdm64.sys) which ships natively with Microsoft Windows. The vulnerability allows a local attacker with low privileges to execute code with elevated system permissions. This is a local attack vector requiring no user interaction. Microsoft has mitigated this by removing the driver entirely in the October 2025 cumulative updates. This vulnerability has been observed being exploited in the wild.
Affected products
- Microsoft Windows Windows 10, 11, Server 2008, 2012, 2016, 2019, 2022, 2025 (x64)
Timeline
- 2025-10-14: disclosed
- 2025-10-14: patched: Driver removed in October cumulative update
- 2025-10-14: kev added
- 2025-10-14: exploited