Vulnerability details
CVE-2025-24990
Actively exploited
Microsoft Windows 10Microsoft Windows 11Microsoft Windows Server
Windows Agere Modem Driver Elevation of Privilege Vulnerability
CVSS 3.1
7.8High
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-11-04)
Versions not listed as affected in the CVE record:
- Windows 10 Version 1507 — version 10.0.10240.21161 and later
- Windows 10 Version 1607 — version 10.0.14393.8519 and later
- Windows 10 Version 1809 — version 10.0.17763.7919 and later
- Windows 10 Version 21H2 — version 10.0.19044.6456 and later
- Windows 10 Version 22H2 — version 10.0.19045.6456 and later
- Windows 11 version 22H2 — version 10.0.22621.6060 and later
Official description
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.8High | 3.1 | CVEProject cvelistV5 (CNA) (microsoft) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Microsoft | Windows 10 Version 1507 | 10.0.10240.0 ≤ v < 10.0.10240.21161 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 ≤ v < 10.0.14393.8519 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 ≤ v < 10.0.17763.7919 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 10 Version 21H2 | 10.0.19044.0 ≤ v < 10.0.19044.6456 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 ≤ v < 10.0.19045.6456 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 ≤ v < 10.0.26100.6899 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 Version 25H2 | 10.0.26200.0 ≤ v < 10.0.26200.6899 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 version 22H2 | 10.0.22621.0 ≤ v < 10.0.22621.6060 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 version 23H2 | 10.0.22631.0 ≤ v < 10.0.22631.6060 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2008 R2 Service Pack 1 | 6.1.7601.0 ≤ v < 6.1.7601.27974 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.1.7601.0 ≤ v < 6.1.7601.27974 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2008 Service Pack 2 | 6.0.6003.0 ≤ v < 6.0.6003.23571 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2008 Service Pack 2 (Server Core installation) | 6.0.6003.0 ≤ v < 6.0.6003.23571 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 | 6.2.9200.0 ≤ v < 6.2.9200.25722 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 ≤ v < 6.2.9200.25722 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 ≤ v < 6.3.9600.22824 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 ≤ v < 6.3.9600.22824 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2016 | 10.0.14393.0 ≤ v < 10.0.14393.8519 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 ≤ v < 10.0.14393.8519 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2019 | 10.0.17763.0 ≤ v < 10.0.17763.7919 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 ≤ v < 10.0.17763.7919 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2022 | 10.0.20348.0 ≤ v < 10.0.20348.4294 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 ≤ v < 10.0.25398.1913 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2025 | 10.0.26100.0 ≤ v < 10.0.26100.6899 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 ≤ v < 10.0.26100.6899 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990 vendor-advisorypatch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24990 government-resource
- https://www.vicarius.io/vsociety/posts/cve-2025-24990-detection-script-elevation-of-privilege-vulnerability-in-agere-modem-driver-affecting-windows
- https://www.vicarius.io/vsociety/posts/cve-2025-24990-mitigation-script-elevation-of-privilege-vulnerability-in-agere-modem-driver-affecting-windows
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-10-14
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- microsoft
- Kolun priority
- 85 · Critical
CISA KEV catalog
- Date added
- 2025-10-14
- Due date
- 2025-11-04
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
6.51%
Probability of exploitation in 30 days
93.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-822Untrusted Pointer Dereference