Windows Agere Modem Driver 0-Day Exploited in Active Privilege Escalation Attacks

A newly discovered zero-day vulnerability in the Windows Agere Modem driver has been actively exploited by threat actors to elevate privileges on affected systems, tracked as CVE-2025-24052 and CVE-2025-24990.

The first flaw is a stack-based buffer overflow in the Agere Modem driver that allows a low-privileged user to execute arbitrary code in kernel context, with high impact to confidentiality, integrity and availability, and the second is an untrusted pointer dereference in the same driver enabling local privilege escalation. Microsoft also scores both as Important with a CVSS v3.1 rating of 7.8, and PoC exploit code for CVE-2025-24052 has been published, increasing patch urgency according to Microsoft.

Both vulnerabilities target the ltmdm64.sys component, included by default in supported Windows releases, and the October 2025 cumulative update removes this vulnerable driver, which could disrupt fax modem hardware dependent on it. Organisations should consider interim mitigations and plan to replace unsupported modem hardware to reduce the attack surface, with IT teams urged to audit inventories and migrate to supported communication solutions.