Windows March 2025: Six Zero-Days in NTFS, FAT, Win32k, MMC

What to do

1. Check every Windows host's build against the March 2025 fixed builds and install the latest cumulative update where it is lower.
2. Block .vhd, .vhdx and .msc files at the mail gateway and web proxy; ordinary users rarely need to receive them.
3. Replace Windows Server 2012/2012 R2 hosts, whose Extended Security Updates ended October 13, 2026, and prioritize Server 2016 patching for the Win32k bug.
4. Hunt for MSC EvilTwin traces and PipeMagic activity on hosts that were unpatched before March 2025.
5. Restrict USB mass storage on kiosks and shared machines to reduce the physical-access NTFS bug.

How to check if you are affected or compromised

• Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR.
• Find .msc files placed in en-US subfolders next to a same-named .msc, or under a fake 'C:\Windows \System32' path with a trailing space.
• Hunt for mmc.exe spawning powershell.exe, and for connections to 82.115.223.182 from Trend Micro's report.
• Search EDR and mail logs for VHD/VHDX files delivered by email or download and mounted by users.

What happened#

On March 11, 2025, Microsoft's Patch Tuesday fixed six Windows bugs it had seen exploited in the wild. CISA added all six to KEV the same day, with an April 1 deadline. They fall into three groups.

Four file-system bugs triggered by a disk image. CVE-2025-24993 is a heap overflow in NTFS, and CVE-2025-24985 is an integer overflow in the Fast FAT driver. Each is scored 7.8 and allows local code execution. CVE-2025-24991, scored 5.5, is an NTFS out-of-bounds read that leaks "small portions of heap memory". For all three, Microsoft's FAQ says an attacker can "trick a local user" into "mounting a specially crafted VHD". CVE-2025-24984, scored 4.6, is a physical attack: someone plugs in "a malicious USB drive", and an NTFS logging flaw exposes portions of heap memory. All four were reported anonymously. No campaign has been named as of Oct 23, 2026. Tenable called CVE-2025-24985 the first Fast FAT bug exploited in the wild.

A Win32k use-after-free used for two years. CVE-2025-24983, scored 7.0, gives SYSTEM, though Microsoft says an attacker must "win a race condition". It was credited to Filip Jurčacko of ESET. ESET told SecurityWeek the exploit was "first seen in the wild in March 2023" and targeted Windows 8.1 and Server 2012 R2. It was delivered through the PipeMagic backdoor. Per The Hacker News, ESET traced the bug to the W32PROCESS structure being dereferenced "one more time than it should" when the WaitForInputIdle API is used in a certain way. A month later, Microsoft found PipeMagic deploying another zero-day, CVE-2025-29824 in CLFS, and linked it to ransomware.

MSC EvilTwin. CVE-2025-26633, scored 7.0, is a security feature bypass in the Microsoft Management Console. It was reported by Aliakbar Zahravi of Trend Micro. Trend's write-up describes the trick. The loader drops two .msc files with the same name, a clean one and a malicious one in an en-US subfolder. "When the clean .msc file is run, mmc.exe loads the malicious file instead." The campaign started with signed MSI installers posing as DingTalk or QQTalk. The loader fetched a Rhadamanthys stealer downloader. The group also uses the EncryptHub stealer and the DarkWisp and SilentPrism backdoors. Trend attributes it to "suspected Russian threat actor Water Gamayun, also known as EncryptHub and Larva-208". It saw an early version of the technique in April 2024. KEV marks this CVE as used by ransomware.

Who is affected#

The NTFS, FAT and MMC bugs affect Windows 10 1507 through 22H2, Windows 11 22H2 through 24H2, and Windows Server 2008 SP2 through 2025. CVE-2025-24984 starts at Server 2012. The Win32k record is narrower: Windows 10 1507 and 1607, and Server 2008 through 2016. Windows 11 is not affected. Fixed builds include 26100.3476 for Windows 11 24H2 and Server 2025, 19045.5608 for Windows 10 22H2, 20348.3328 for Server 2022 and 14393.7876 for Server 2016.

Do you really need to act?#

For patched fleets, no. Every cumulative update since March 2025 includes these fixes. Each bug still needs something first: a user who mounts a disk image or opens an MSC file, physical access, or local code execution. What remains is old hosts. The Win32k exploit ran for two years against Server 2012 R2-era systems. Windows Server 2012 and 2012 R2 Extended Security Updates ended on October 13, 2026, so those hosts will get no fixes for anything newer. The delivery tricks also outlive the patches. Immersive's Kev Breen told The Hacker News that attackers have long used VHD files in phishing to smuggle malware past antivirus.

What to do now#

1. Read each host's build with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR and install the latest cumulative update where it is below the March 2025 builds.
2. Block .vhd, .vhdx and .msc attachments and downloads for ordinary users.
3. Replace Server 2012 and 2012 R2 hosts. Make sure Server 2016 and Windows 10 1607 LTSB machines are current.
4. Restrict USB mass storage on kiosks and shared machines.

How to tell if you were hit#

For MSC EvilTwin, look for .msc files in en-US subfolders that sit next to a same-named .msc. Look for paths under a fake C:\Windows \System32 with a trailing space, and for mmc.exe starting powershell.exe. Check for traffic to 82.115.223.182, and match Trend's IOC list. For the file-system bugs, search mail and EDR logs for VHD files that users received and mounted. For CVE-2025-24983, neither ESET nor Microsoft has published indicators in the sources we reviewed. Treat any PipeMagic detection on an older server as a full compromise.

Timeline#

• Mar 2023 — ESET first sees the Win32k exploit in the wild.
• Apr 2024 — Trend sees an early version of the MSC EvilTwin technique.
• Mar 11, 2025 — Microsoft fixes all six. CISA adds them to KEV.
• Mar 25, 2025 — Trend publishes its Water Gamayun analysis.
• Apr 1, 2025 — CISA's federal deadline.
• Oct 13, 2026 — Server 2012/2012 R2 Extended Security Updates end.

Vulnerability records

• CVE-2025-24993 · KEV 2025-03-11 · Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
• CVE-2025-24991 · KEV 2025-03-11 · Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
• CVE-2025-24985 · KEV 2025-03-11 · Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
• CVE-2025-24984 · KEV 2025-03-11 · Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
• CVE-2025-24983 · KEV 2025-03-11 · Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
• CVE-2025-26633 · KEV 2025-03-11 · Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2025-24983 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — CVE-2025-26633 Microsoft Management Console Security Feature Bypass Vulnerability msrc.microsoft.com
3. Microsoft MSRC — March 2025 Security Updates (CVRF data with FAQ, KB numbers and acknowledgments) api.msrc.microsoft.com
4. CVE record — CVE-2025-24993 cve.org
5. CVE record — CVE-2025-24983 cve.org
6. CVE record — CVE-2025-26633 cve.org
7. NVD — CVE-2025-24993 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2025-26633 cisa.gov
9. Trend Micro — CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin trendmicro.com
10. Microsoft Threat Intelligence — Exploitation of CLFS zero-day leads to ransomware activity microsoft.com
11. Microsoft Learn — Windows Server 2012 and 2012 R2 reaching end of support learn.microsoft.com
12. Tenable — Microsoft's March 2025 Patch Tuesday Addresses 56 CVEs (CVE-2025-26633, CVE-2025-24983) tenable.com

Coverage and analysis

1. SecurityWeek — Newly Patched Windows Zero-Day Exploited for Two Years securityweek.com
2. BleepingComputer — Microsoft patches Windows Kernel zero-day exploited since 2023 bleepingcomputer.com
3. The Hacker News — Urgent: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero-Days thehackernews.com