CVE-2025-24990: Microsoft Windows untrusted pointer dereference in Agere Modem Driver

CVE-2025-24990 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2025-10-14

A security vulnerability exists in a modem driver that is included by default in most versions of Microsoft Windows. This flaw allows an attacker who already has basic access to a computer to gain full administrator control, potentially leading to data theft or the installation of persistent malware. Microsoft has addressed this by completely removing the affected driver in recent security updates, which may cause older fax modem hardware to stop functioning.

Technologies: Microsoft Windows. Vendors: Microsoft.

Quick answers

Is CVE-2025-24990 exploited in the wild?
Yes. CVE-2025-24990 is known to be exploited in the wild, first recorded on 14 October 2025. Treat it as urgent.
How severe is CVE-2025-24990?
Critical severity, with a CVSS score of 7.8, published 14 October 2025.
Which products and versions are affected?
Microsoft Windows Windows 10, 11, Server 2008, 2012, 2016, 2019, 2022, 2025 (x64).
Is there a fix for CVE-2025-24990?
A patch was published on 2025-10-14: Driver removed in October cumulative update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24990 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-24990?
Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An untrusted pointer dereference vulnerability (CWE-822) exists in the Agere Modem driver (ltmdm64.sys) which ships natively with Microsoft Windows. The vulnerability allows a local attacker with low privileges to execute code with elevated system permissions. This is a local attack vector requiring no user interaction. Microsoft has mitigated this by removing the driver entirely in the October 2025 cumulative updates. This vulnerability has been observed being exploited in the wild.

Affected products

  • Microsoft Windows Windows 10, 11, Server 2008, 2012, 2016, 2019, 2022, 2025 (x64)

Timeline

  • 2025-10-14: disclosed
  • 2025-10-14: patched: Driver removed in October cumulative update
  • 2025-10-14: kev added
  • 2025-10-14: exploited

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.