Windows NTFS Information Disclosure Vulnerability (CVE-2025-24984) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-24984) exists in the Windows New Technology File System (NTFS). NTFS maintains system transaction logs (such as $LogFile and $UsnJrnl) to guarantee file system integrity during unexpected shutdowns. A design flaw (CWE-532) causes sensitive system or user data to be written into these log files in an unencrypted format. This allows an attacker with physical access to bypass operating system-level access controls and read sensitive data directly from the storage media.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must obtain physical access to the target machine (AV:P). The attacker can shut down the system, boot via an external malicious operating system (e.g., a Live USB), or physically extract the storage drive to mount it on an attacker-controlled analysis machine. By parsing the raw NTFS metadata structures and reading the $LogFile, the attacker can recover sensitive data fragments, such as credentials or cryptographic keys, that were cached during active file operations. This vulnerability is actively exploited in the wild and is cataloged in CISA's KEV.

3. Infrastructure & Business Impact

This vulnerability poses a severe threat to remote offices, data centers with weak physical security, and corporate laptops susceptible to loss or theft. If an attacker extracts domain credentials or local administrator password hashes from the NTFS logs, they can leverage this information to perform lateral movement, compromise active directory domains, and escalate privileges across the entire corporate infrastructure.