VulnSocial

CVE-2025-24990Patch(microsoft / windows_10_1507)

MEDIUMCVSS 7.8 · HIGHCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch microsoft windows_10_1507 systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.

microsoft CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-11-04. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-822

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1507
  • windows_10_1607
  • windows_10_1809
  • windows_10_21h2

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
microsoft
Products
windows_10_1507windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_server_2008

2 versions affected across 16 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-21: 1Active Exploitation · 2026-05-21: 1Patch / Workaround · 2026-05-21: 1Technical Details · 2026-05-21: 105-21
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • CVE Brief@DailyCVEBrief
    Patch

    Last October, Microsoft did something rare: instead of patching a bug, they deleted the driver. CVE-2025-24990 was a kernel EoP in a 56K-modem driver Windows had shipped for two decades — exploited in the wild against an install base of essentially nobody.

    Post summary

    Microsoft removed the legacy 56k modem driver for CVE-2025-24990 rather than patching it; the kernel elevation‑of‑privilege flaw had been exploited in the wild but only against a negligible install base.

    10000766
    18 followersView on X
CPE platform detail18 entries

18 of 18 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1507--x64
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_21h2--x64
OSmicrosoftwindows_10_22h2--x64
OSmicrosoftwindows_11_22h2--x64
OSmicrosoftwindows_11_23h2--x64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_11_25h2--x64
OSmicrosoftwindows_server_2008--x64
OSmicrosoftwindows_server_2008r2-x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2022_23h2---
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEswindows_10_1507 vulnerabilities