---
title: "Windows Agere Modem and RasMan Zero-Days (Oct 2025)"
url: https://erroneo.us/security/briefs/windows-agere-modem-rasman-cve-2025-24990-cve-2025-59230/
description: "Two exploited Windows privilege-escalation bugs fixed Oct 14, 2025: the Agere modem driver was removed and RasMan patched. Check hosts are on that update."
type: security-brief
section: "Security Digest"
date_published: 2025-10-14
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-24990", "CVE-2025-59230"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Windows Agere Modem and RasMan Zero-Days (Oct 2025)

**Verdict: Check exposure.** Both bugs were fixed in the October 2025 cumulative update a year ago; confirm no Windows host is older than that, and remember that later Windows zero-days need later updates.

- **Who must act:** Owners of Windows client or server hosts below the October 2025 builds, and of Windows 10 devices outside Extended Security Updates, which received no fixes after that month.
- **Who can relax:** Fleets on current cumulative updates. Teams that still depend on Agere-based fax modems should plan a replacement, because Microsoft removed the driver instead of patching it.
- **Affected:** All supported Windows client and server releases before the October 14, 2025 updates, from Server 2008 SP2 through Windows 11 25H2 and Server 2025; CVE-2025-24990: any system with the inbox ltmdm64.sys driver, even if no modem is in use
- **Fixed:** Windows 11 24H2 build 26100.6899 and 25H2 build 26200.6899 (KB5066835); Windows 11 23H2 build 22631.6060 (KB5066793); Windows 10 22H2 build 19045.6456 (KB5066791); Windows Server 2025 build 26100.6899 (KB5066835); Windows Server 2022 build 20348.4294 (KB5066782); Windows Server 2019 build 17763.7919 (KB5066586); Windows Server 2016 build 14393.8519 (KB5066836)
- **CVEs:** CVE-2025-24990, CVE-2025-59230
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Compare every Windows host's build and UBR with the October 2025 fixed builds and install the latest cumulative update on anything older.
2. Confirm the Agere driver is gone: Test-Path C:\Windows\System32\drivers\ltmdm64.sys should return False on updated systems.
3. Retire fax-modem workflows that relied on the Agere driver; do not reinstall the old driver to bring them back.
4. Enroll remaining Windows 10 devices in Extended Security Updates or upgrade them, since unenrolled devices miss every fix after October 2025.
5. Treat both as second-stage bugs: keep pressure on initial access (phishing, exposed services) and make sure EDR covers every host.

### How to check if you are affected

- Use EDR or driverquery /v to find hosts where ltmdm64.sys was still loaded before they took the October 2025 update.
- Hunt EDR history from before mid-October 2025 for low-privilege processes that spawned SYSTEM processes, a common sign of local privilege escalation.
- Review System event logs for unexpected Remote Access Connection Manager (RasMan) service crashes before the patch, which may accompany exploit attempts.

## What happened

On October 14, 2025, Microsoft's Patch Tuesday fixed two Windows privilege-escalation bugs that were already under attack. Microsoft marks both "Exploitation Detected." CISA added both to its KEV catalog the same day, with a November 4, 2025 federal deadline.

- **CVE-2025-24990** is an untrusted pointer dereference (CWE-822) in ltmdm64.sys, the third-party Agere modem driver that ships with Windows. Microsoft says an attacker "could gain administrator privileges," even if the modem is not in use. Microsoft did not patch the driver. Its [advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990) says "the driver has been removed in the October cumulative update" and that dependent fax modem hardware "will no longer work on Windows." The same removal fixes [CVE-2025-24052](https://www.cve.org/CVERecord?id=CVE-2025-24052), a publicly disclosed stack overflow in that driver.
- **CVE-2025-59230** is an improper access control flaw (CWE-284) in the Windows Remote Access Connection Manager (RasMan). Microsoft's [advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230) says a local, authorized attacker can gain SYSTEM, and credits its own threat intelligence (MSTIC) and MSRC. [Tenable](https://www.tenable.com/blog/microsofts-october-2025-patch-tuesday-addresses-167-cves-cve-2025-24990-cve-2025-59230) calls it "the first reported RasMan CVE to be exploited as a zero-day." It counts 22 RasMan bugs patched since January 2022.

Microsoft scores both CVSS 3.1 7.8 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-59230). The same release fixed a third exploited bug, the IGEL OS Secure Boot bypass [CVE-2025-47827](https://www.cve.org/CVERecord?id=CVE-2025-47827). It was also the day [Windows 10 support ended](https://www.microsoft.com/en-us/windows/end-of-support).

## Who is affected

Every supported Windows release before the October 2025 update, from Server 2008 SP2 through Windows 11 25H2 and Server 2025. Fixed builds include 26100.6899 for Windows 11 24H2 and Server 2025, 22631.6060 for Windows 11 23H2, 19045.6456 for Windows 10 22H2, 20348.4294 for Server 2022 and 17763.7919 for Server 2019. The full table is on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-24990).

## Do you really need to act?

Probably not, if your patching works. Both bugs are local. An attacker needs code running on the machine first, then uses the bug to reach SYSTEM, turn off defenses and steal credentials. [CrowdStrike](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2025/) says it "identified a local privilege escalation binary" exploiting the RasMan bug in October 2025. The activity was not tied to a tracked adversary, but "was likely conducted by an eCrime group." No one has publicly attributed the Agere exploitation as of Oct 23, 2026.

One year on, any host with the October 2025 update or later is fixed. The gap is machines that stopped updating. Windows 10 devices outside Extended Security Updates got this fix but nothing after it, including the November and December 2025 kernel zero-days CVE-2025-62215 and CVE-2025-62221. RasMan also returned to KEV in February 2026 with [CVE-2026-21525](https://www.cve.org/CVERecord?id=CVE-2026-21525), a denial-of-service bug.

## What to do now

1. Check builds across the fleet, for example `Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object CurrentBuild,UBR`, and install the latest cumulative update on anything older than October 2025.
2. Confirm the driver is gone: `Test-Path C:\Windows\System32\drivers\ltmdm64.sys` should return `False`.
3. Replace any fax-modem workflow that relied on the Agere driver. Do not reinstall the old driver.
4. Enroll remaining Windows 10 devices in ESU or upgrade them.

## How to tell if you were hit

Neither Microsoft nor CrowdStrike has published indicators, per the sources above, as of Oct 23, 2026. Hunt EDR history from before mid-October 2025 for low-privilege processes that spawned SYSTEM processes, and for new services or drivers. Look for unexpected RasMan service crashes in the System log, which may accompany exploit attempts. Use `driverquery /v` or EDR inventory to see which hosts still loaded ltmdm64.sys before patching.

## Timeline

- Oct 14, 2025 — Microsoft fixes both bugs and removes ltmdm64.sys; CISA adds both to KEV; Windows 10 support ends.
- Nov 4, 2025 — Federal remediation deadline.
- Feb 10, 2026 — CISA adds RasMan denial-of-service bug CVE-2026-21525 to KEV.

## Sources

1. [Microsoft — CVE-2025-24990 Windows Agere Modem Driver Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990)
2. [Microsoft — CVE-2025-59230 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230)
3. [CVE record — CVE-2025-24990](https://www.cve.org/CVERecord?id=CVE-2025-24990)
4. [CVE record — CVE-2025-59230](https://www.cve.org/CVERecord?id=CVE-2025-59230)
5. [NVD — CVE-2025-24990](https://nvd.nist.gov/vuln/detail/CVE-2025-24990)
6. [NVD — CVE-2025-59230](https://nvd.nist.gov/vuln/detail/CVE-2025-59230)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-24990](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24990)
8. [CISA — Known Exploited Vulnerabilities: CVE-2025-59230](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59230)
9. [Microsoft — Windows 10 end of support](https://www.microsoft.com/en-us/windows/end-of-support)
10. [CVE record — CVE-2025-24052](https://www.cve.org/CVERecord?id=CVE-2025-24052)
11. [CVE record — CVE-2025-47827](https://www.cve.org/CVERecord?id=CVE-2025-47827)
12. [CVE record — CVE-2026-21525](https://www.cve.org/CVERecord?id=CVE-2026-21525)
13. [CrowdStrike — October 2025 Patch Tuesday: Two Publicly Disclosed, Three Zero-Days, and Eight Critical Vulnerabilities Among 172 CVEs](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2025/)
14. [Tenable — Microsoft's October 2025 Patch Tuesday Addresses 167 CVEs (CVE-2025-24990, CVE-2025-59230)](https://www.tenable.com/blog/microsofts-october-2025-patch-tuesday-addresses-167-cves-cve-2025-24990-cve-2025-59230)

---
Source page: https://erroneo.us/security/briefs/windows-agere-modem-rasman-cve-2025-24990-cve-2025-59230/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt