cve-2025-21180

CVE-2025-21180 is a critical heap-based buffer overflow vulnerability in the Windows exFAT file system. Discovered in early 2025, it allows a local attacker to execute arbitrary code, potentially leading to full system compromise. The flaw affects all supported versions of Windows that mount exFAT volumes. Microsoft released a security update in February 2025 to address the issue. Discussions on WindowsForum cover the technical details of the vulnerability, its CVSS score of 8.8, and practical steps for mitigation, including applying the latest patches and limiting access to untrusted exFAT drives. Users are advised to prioritize this update due to the risk of privilege escalation and data corruption.