https://vulnerability.circl.lu Contains only the most 10 recent comments. http://www.rssboard.org/rss-specification python-feedgen en Thu, 17 Sep 2026 09:57:58 +0000 https://vulnerability.circl.lu/comment/00b15597-d2d6-413f-b3a1-38c62db1e6b0 - CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted .library-ms file. Active exploitation in the wild has been observed since March 19, 2025, potentially allowing attackers to leak NTLM hashes or user passwords and compromise systems. Although Microsoft released a patch on March 11, 2025, threat actors already had over a week to develop and deploy exploits before the vulnerability began to be actively abused. - Around March 20–21, 2025, a campaign targeted government and private institutions in Poland and Romania. Attackers used malspam to distribute a Dropbox link containing an archive that exploited multiple known vulnerabilities, including CVE-2025-24054, to harvest NTLMv2-SSP hashes. - Initial reports suggested that exploitation occurred once the .library-ms file was unzipped. However, Microsoft’s patch documentation indicated that the vulnerability could even be triggered with minimal user interaction, such as right-clicking, dragging and dropping, or simply navigating to the folder containing the malicious file. This exploit appears to be a variant of a previously patched vulnerability, CVE-2024-43451, as both share several similarities. For more details: [CVE-2025-24054, NTLM Exploit in the Wild](https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/) - CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted .library-ms file. Active exploitation in the wild has been observed since March 19, 2025, potentially allowing attackers to leak NTLM hashes or user passwords and compromise systems. Although Microsoft released a patch on March 11, 2025, threat actors already had over a week to develop and deploy exploits before the vulnerability began to be actively abused. - Around March 20–21, 2025, a campaign targeted government and private institutions in Poland and Romania. Attackers used malspam to distribute a Dropbox link containing an archive that exploited multiple known vulnerabilities, including CVE-2025-24054, to harvest NTLMv2-SSP hashes. - Initial reports suggested that exploitation occurred once the .library-ms file was unzipped. However, Microsoft’s patch documentation indicated that the vulnerability could even be triggered with minimal user interaction, such as right-clicking, dragging and dropping, or simply navigating to the folder containing the malicious file. This exploit appears to be a variant of a previously patched vulnerability, CVE-2024-43451, as both share several similarities. For more details: [CVE-2025-24054, NTLM Exploit in the Wild](https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/) https://vulnerability.circl.lu/comment/00b15597-d2d6-413f-b3a1-38c62db1e6b0 Fri, 18 Apr 2025 12:00:09 +0000 https://vulnerability.circl.lu/comment/ee7a81f6-1013-4ce2-9180-897e57934f51 Apple has released emergency security updates to patch a zero-day bug the company describes as exploited in "extremely sophisticated" attacks. The vulnerability is tracked as CVE-2025-24201 and was found in the WebKit cross-platform web browser engine used by Apple's Safari web browser and many other apps and web browsers on macOS, iOS, Linux, and Windows. Apple has released emergency security updates to patch a zero-day bug the company describes as exploited in "extremely sophisticated" attacks. The vulnerability is tracked as CVE-2025-24201 and was found in the WebKit cross-platform web browser engine used by Apple's Safari web browser and many other apps and web browsers on macOS, iOS, Linux, and Windows. https://vulnerability.circl.lu/comment/ee7a81f6-1013-4ce2-9180-897e57934f51 Wed, 12 Mar 2025 08:35:57 +0000 https://vulnerability.circl.lu/comment/e2a22b2f-4064-4f7f-a7c5-6b9f4b3cd280 ### Executive Summary This report updates the findings on CVE-2025-24085, a use-after-free vulnerability affecting Apple's IDS subsystem and iMessage's BlastDoor sandboxing. Findings (As of February 20, 2025) iOS 18.3.1 remains vulnerable despite Apple's February 19, 2025, mitigation deadline. BlastDoor is bypassed, enabling unsandboxed iMessage processing. Privilege escalation attempts detected, suggesting a possible kernel exploit. Unauthorized decryption and authentication tampering observed, raising concerns about iMessage interception and data exposure. The exploit remains active in the wild, requiring immediate action. https://github.com/orgs/community/discussions/152523 ### Executive Summary This report updates the findings on CVE-2025-24085, a use-after-free vulnerability affecting Apple's IDS subsystem and iMessage's BlastDoor sandboxing. Findings (As of February 20, 2025) iOS 18.3.1 remains vulnerable despite Apple's February 19, 2025, mitigation deadline. BlastDoor is bypassed, enabling unsandboxed iMessage processing. Privilege escalation attempts detected, suggesting a possible kernel exploit. Unauthorized decryption and authentication tampering observed, raising concerns about iMessage interception and data exposure. The exploit remains active in the wild, requiring immediate action. https://github.com/orgs/community/discussions/152523 https://vulnerability.circl.lu/comment/e2a22b2f-4064-4f7f-a7c5-6b9f4b3cd280 Thu, 27 Feb 2025 08:00:55 +0000 https://vulnerability.circl.lu/comment/c2248f9d-e2e0-4af2-a57c-e3b393cffb55 UPDATE: Fortinet has informed us that the new CVE-2025-24472 flaw added to FG-IR-24-535 today is not a zero-day and was already fixed in January, but not disclosed then. Furthermore, even though the current advisory states that the listed flaws were exploited in attacks and includes workarounds, Fortinet says that only CVE-2024-55591, and not CVE-2025-24472. It appears that this new CVE is for a different pathway to exploiting the bug that was not previously disclosed and was just now added to the Fortinet advisory about the active exploitation of CVE-2024-55591, causing the confusion. We have updated this previous toot, changed the title of our article, and added an update to prevent confusion. Ref: https://infosec.exchange/@BleepingComputer/113986777248862223 UPDATE: Fortinet has informed us that the new CVE-2025-24472 flaw added to FG-IR-24-535 today is not a zero-day and was already fixed in January, but not disclosed then. Furthermore, even though the current advisory states that the listed flaws were exploited in attacks and includes workarounds, Fortinet says that only CVE-2024-55591, and not CVE-2025-24472. It appears that this new CVE is for a different pathway to exploiting the bug that was not previously disclosed and was just now added to the Fortinet advisory about the active exploitation of CVE-2024-55591, causing the confusion. We have updated this previous toot, changed the title of our article, and added an update to prevent confusion. Ref: https://infosec.exchange/@BleepingComputer/113986777248862223 https://vulnerability.circl.lu/comment/c2248f9d-e2e0-4af2-a57c-e3b393cffb55 Wed, 12 Feb 2025 05:40:06 +0000