Microsoft Windows Agere Modem Driver (ltmdm64.sys) Privilege Escalation Vulnerability (CVE-2025-24990) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMicrosoft Windows operating systems with the third-party Agere Modem driver (ltmdm64.sys) installed or natively shipped
Local attackers can execute arbitrary code with SYSTEM privileges, leading to full host compromise. This vulnerability is actively exploited in the wild (CISA KEV)
Apply the Microsoft October cumulative update to completely remove the driver, or manually disable and restrict the driver service
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Microsoft has deprecated and removed this driver in the October cumulative update. Use the following PowerShell commands to force-install the latest Windows updates:
# Install and import the Windows Update module to apply the latest cumulative patch
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, disable the Agere Modem service and restrict access to the vulnerable driver file to prevent it from loading.
# Stop and disable the Agere Modem service
Stop-Service -Name 'AgereModemService' -ErrorAction SilentlyContinue
Set-Service -Name 'AgereModemService' -StartupType Disabled -ErrorAction SilentlyContinue
# Restrict execution permissions on the vulnerable driver file
$driverPath = 'C:\Windows\System32\drivers\ltmdm64.sys'
if (Test-Path $driverPath) {
takeown /f $driverPath
icacls $driverPath /deny 'EVERYONE:(F)'
}3. Log Audit & IoC Verification Commands
Run the following script to verify if the vulnerable ltmdm64.sys driver is present or loaded on the system.
# Check for the existence of the vulnerable driver file
$driverFile = 'C:\Windows\System32\drivers\ltmdm64.sys'
if (Test-Path $driverFile) {
Write-Host '[WARNING] Vulnerable Agere driver file (ltmdm64.sys) detected!' -ForegroundColor Red
Get-Item $driverFile | Select-Object Name, Length, CreationTime, LastWriteTime | Format-List
} else {
Write-Host '[SAFE] Agere driver file (ltmdm64.sys) is not present.' -ForegroundColor Green
}
# Query active PnP drivers to check if Agere driver is registered
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like '*Agere*' -or $_.DriverProviderName -like '*Agere*' } | Select-Object DeviceName, DriverVersion, InfNameBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-24990) exists in the third-party Agere Modem driver (ltmdm64.sys) that historically shipped natively with supported Windows operating systems. The root cause is attributed to improper pointer dereferencing or memory management (CWE-822) within the driver's kernel-mode execution context. This allows a local attacker to interact with the driver via specific Input/Output Control (IOCTL) requests to manipulate kernel memory structures.
2. Exploitation Mechanics & Attack Scenario
An attacker with low-privilege local access initiates the exploit by opening a handle to the Agere Modem device interface (e.g., \\.\AgereModem). By crafting and sending malicious IOCTL codes, the attacker triggers an invalid pointer dereference within ltmdm64.sys. This memory corruption allows the attacker to overwrite critical kernel structures or function pointers, hijacking the execution flow to run arbitrary payloads with SYSTEM privileges.
3. Infrastructure & Business Impact
With a CVSS score of 7.8 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat. Successful exploitation bypasses endpoint security controls (EDR/AV), enabling attackers to dump credentials, deploy ransomware, establish persistence, and pivot laterally across the enterprise network.
Official Vendor Advisories & References
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
Frequently Asked SecOps Questions (CVE-2025-24990)
FAQQ1. How critical is CVE-2025-24990 and is it actively exploited in the wild?
CVE-2025-24990 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 6.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-24990?
Primary impacted vendors include microsoft, agere across windows, agere modem driver. Scope summary: All supported versions of Microsoft Windows containing or running the Agere Modem driver (ltmdm64.sys)
Q3. What temporary mitigations or workarounds exist for CVE-2025-24990 before patching?
[Mitigation] Apply the Microsoft October cumulative update to completely remove the driver, or manually disable and restrict the driver service Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-24990
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.