CVE-2025-24990

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-822

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Oct 14, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-249915.5Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.CVE-2025-249925.5Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.CVE-2025-249937.8Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.CVE-2025-249947.3Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2025-249957.8Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.CVE-2025-249966.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.CVE-2025-249974.4Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally.CVE-2025-249987.3Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-249998.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-25007.4A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gaiCVE-2025-250008.8Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute CVE-2025-250014.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthoriz