Windows Agere Modem and RasMan Zero-Days (Oct 2025)

What to do

1. Compare every Windows host's build and UBR with the October 2025 fixed builds and install the latest cumulative update on anything older.
2. Confirm the Agere driver is gone: Test-Path C:\Windows\System32\drivers\ltmdm64.sys should return False on updated systems.
3. Retire fax-modem workflows that relied on the Agere driver; do not reinstall the old driver to bring them back.
4. Enroll remaining Windows 10 devices in Extended Security Updates or upgrade them, since unenrolled devices miss every fix after October 2025.
5. Treat both as second-stage bugs: keep pressure on initial access (phishing, exposed services) and make sure EDR covers every host.

How to check if you are affected or compromised

• Use EDR or driverquery /v to find hosts where ltmdm64.sys was still loaded before they took the October 2025 update.
• Hunt EDR history from before mid-October 2025 for low-privilege processes that spawned SYSTEM processes, a common sign of local privilege escalation.
• Review System event logs for unexpected Remote Access Connection Manager (RasMan) service crashes before the patch, which may accompany exploit attempts.

What happened#

On October 14, 2025, Microsoft's Patch Tuesday fixed two Windows privilege-escalation bugs that were already under attack. Microsoft marks both "Exploitation Detected." CISA added both to its KEV catalog the same day, with a November 4, 2025 federal deadline.

• CVE-2025-24990 is an untrusted pointer dereference (CWE-822) in ltmdm64.sys, the third-party Agere modem driver that ships with Windows. Microsoft says an attacker "could gain administrator privileges," even if the modem is not in use. Microsoft did not patch the driver. Its advisory says "the driver has been removed in the October cumulative update" and that dependent fax modem hardware "will no longer work on Windows." The same removal fixes CVE-2025-24052, a publicly disclosed stack overflow in that driver.
• CVE-2025-59230 is an improper access control flaw (CWE-284) in the Windows Remote Access Connection Manager (RasMan). Microsoft's advisory says a local, authorized attacker can gain SYSTEM, and credits its own threat intelligence (MSTIC) and MSRC. Tenable calls it "the first reported RasMan CVE to be exploited as a zero-day." It counts 22 RasMan bugs patched since January 2022.

Microsoft scores both CVSS 3.1 7.8 on the CVE record. The same release fixed a third exploited bug, the IGEL OS Secure Boot bypass CVE-2025-47827. It was also the day Windows 10 support ended.

Who is affected#

Every supported Windows release before the October 2025 update, from Server 2008 SP2 through Windows 11 25H2 and Server 2025. Fixed builds include 26100.6899 for Windows 11 24H2 and Server 2025, 22631.6060 for Windows 11 23H2, 19045.6456 for Windows 10 22H2, 20348.4294 for Server 2022 and 17763.7919 for Server 2019. The full table is on the CVE record.

Do you really need to act?#

Probably not, if your patching works. Both bugs are local. An attacker needs code running on the machine first, then uses the bug to reach SYSTEM, turn off defenses and steal credentials. CrowdStrike says it "identified a local privilege escalation binary" exploiting the RasMan bug in October 2025. The activity was not tied to a tracked adversary, but "was likely conducted by an eCrime group." No one has publicly attributed the Agere exploitation as of Oct 23, 2026.

One year on, any host with the October 2025 update or later is fixed. The gap is machines that stopped updating. Windows 10 devices outside Extended Security Updates got this fix but nothing after it, including the November and December 2025 kernel zero-days CVE-2025-62215 and CVE-2025-62221. RasMan also returned to KEV in February 2026 with CVE-2026-21525, a denial-of-service bug.

What to do now#

1. Check builds across the fleet, for example Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild,UBR, and install the latest cumulative update on anything older than October 2025.
2. Confirm the driver is gone: Test-Path C:\Windows\System32\drivers\ltmdm64.sys should return False.
3. Replace any fax-modem workflow that relied on the Agere driver. Do not reinstall the old driver.
4. Enroll remaining Windows 10 devices in ESU or upgrade them.

How to tell if you were hit#

Neither Microsoft nor CrowdStrike has published indicators, per the sources above, as of Oct 23, 2026. Hunt EDR history from before mid-October 2025 for low-privilege processes that spawned SYSTEM processes, and for new services or drivers. Look for unexpected RasMan service crashes in the System log, which may accompany exploit attempts. Use driverquery /v or EDR inventory to see which hosts still loaded ltmdm64.sys before patching.

Timeline#

• Oct 14, 2025 — Microsoft fixes both bugs and removes ltmdm64.sys; CISA adds both to KEV; Windows 10 support ends.
• Nov 4, 2025 — Federal remediation deadline.
• Feb 10, 2026 — CISA adds RasMan denial-of-service bug CVE-2026-21525 to KEV.

Vulnerability records

• CVE-2025-24990 · KEV 2025-10-14 · Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems.
• CVE-2025-59230 · KEV 2025-10-14 · Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — CVE-2025-24990 Windows Agere Modem Driver Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft — CVE-2025-59230 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability msrc.microsoft.com
3. CVE record — CVE-2025-24990 cve.org
4. CVE record — CVE-2025-59230 cve.org
5. NVD — CVE-2025-24990 nvd.nist.gov
6. NVD — CVE-2025-59230 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2025-24990 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2025-59230 cisa.gov
9. Microsoft — Windows 10 end of support microsoft.com
10. CVE record — CVE-2025-24052 cve.org
11. CVE record — CVE-2025-47827 cve.org
12. CVE record — CVE-2026-21525 cve.org
13. CrowdStrike — October 2025 Patch Tuesday: Two Publicly Disclosed, Three Zero-Days, and Eight Critical Vulnerabilities Among 172 CVEs crowdstrike.com
14. Tenable — Microsoft's October 2025 Patch Tuesday Addresses 167 CVEs (CVE-2025-24990, CVE-2025-59230) tenable.com