CVE-2025-7771
Code Execution / Escalation of Privileges in ThrottleStop
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Code Execution / Escalation of Privileges in ThrottleStop
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
Reserved 2025-07-17 | Published 2025-08-06 | Updated 2025-08-06 | Assigner KasperskyCWE-782: Exposed IOCTL with Insufficient Access Control
github.com/...visories/blob/master/K-TechPowerUp-2025-001.md
www.techpowerup.com/download/techpowerup-throttlestop/
securelist.com/av-killer-exploiting-throttlestop-sys/117026/
Support options
