BURIED IN THE LOG. EXPLOITING A 20 YEARS OLD NTFS VULNERABILITY

Summary from the TLDR InfoSec newsletter

This research reveals a 20-year-old NTFS vulnerability (CVE-2025-49689) that can be exploited via crafted Virtual Hard Disk (VHD) files, causing an integer overflow during mounting. Malicious VHDs bypass Log File Service (LFS) validation, enabling out-of-bounds memory reads and kernel-level code execution through pointer hijacking and IO_RING primitives. It shows how legacy filesystem code remains a target, especially with modern file formats used in phishing campaigns.