Is CVE-2025-24990 being actively exploited?

Yes. CVE-2025-24990 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on October 14, 2025.

What is the CVSS score for CVE-2025-24990?

CVE-2025-24990 has a CVSS 3.1 base score of 7.8 (HIGH).

CVE-2025-24990

HIGH · CVSS 7.8CISA KEV: actively exploitedEPSS 6.4%EU EUVD: exploited

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.

Key facts

CVSS score: 7.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-822
EPSS score: 6.4% (94th percentile)
In CISA KEV: Yes, added October 14, 2025
In EU EUVD: Yes (EUVD-2025-34257)
Published: October 14, 2025
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Microsoft Windows Untrusted Pointer Dereference Vulnerability

Added to the KEV catalog on October 14, 2025; federal remediation due November 4, 2025.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-34257 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

microsoft / windows 10 1507
microsoft / windows 10 1607
microsoft / windows 10 1809
microsoft / windows 10 21h2
microsoft / windows 10 22h2
microsoft / windows 11 22h2
microsoft / windows 11 23h2
microsoft / windows 11 24h2
microsoft / windows 11 25h2
microsoft / windows server 2008
microsoft / windows server 2008
microsoft / windows server 2012
microsoft / windows server 2012
microsoft / windows server 2016
microsoft / windows server 2019
microsoft / windows server 2022
microsoft / windows server 2022 23h2
microsoft / windows server 2025

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Microsoft Windows 10 and Server version 1903 (May 2019 Update) - Microsoft Corporation - Common Criteria 2019-22-INF-2839 - archived

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24990(US Government Resource)
https://www.vicarius.io/vsociety/posts/cve-2025-24990-detection-script-elevation-of-privilege-vulnerability-in-agere-modem-driver-affecting-windows(Third Party Advisory)
https://www.vicarius.io/vsociety/posts/cve-2025-24990-mitigation-script-elevation-of-privilege-vulnerability-in-agere-modem-driver-affecting-windows(Mitigation, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain