CVE-2025-24054 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: MEDIUM

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-03-11

Added to CISA KEV: 2025-04-17 37 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review authentication logs for suspicious NTLM authentication attempts, check for unauthorized access, verify domain controller and server integrity
Apply Microsoft security updates immediately for all affected Windows systems
Monitor NTLM authentication logs for unusual patterns or failed authentication attempts
Consider implementing Kerberos authentication where possible to reduce NTLM attack surface
Patch priority: CRITICAL for internet-facing Windows Server systems, HIGH for internal Windows systems

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-24054 is a critical security vulnerability involving the external control of file names or paths in Windows NTLM, which allows an unauthorized attacker to perform spoofing over a network ^[4].

Key Details

Feature	Status/Description
Active Exploitation	Yes, observed in the wild starting around March 19, 2025 ^[1].
Attack Method	Exploited by using a maliciously crafted `.library-ms` file, which, when extracted from a ZIP archive, triggers Windows Explorer to leak NTLMv2-SSP hashes ^[1].
Requirements	Requires user interaction (e.g., opening or extracting a malicious file) ^[1].
Impact	Allows attackers to leak NTLM hashes or user passwords, potentially leading to system compromise or network spoofing ^[1].
Ransomware/Targeted	Usage in known ransomware campaigns is currently unknown ^[3].
Patch Status	Patched by Microsoft on March 11, 2025 ^[1].

Additional Context

Exploitation Timeline: Although Microsoft released a patch on March 11, 2025, threat actors had over a week to develop and deploy exploits before active abuse was observed in the wild ^[1].
CISA Status: The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog, with a remediation due date of May 8, 2025 ^[3].
Mitigation: The primary recommendation is to apply the March 2025 Microsoft security updates. In environments where NTLM is not strictly required, disabling it is considered a broader security best practice to prevent NTLM relay and similar spoofing attacks ^[2].

Sources