OnlyPatch
Kernel Streaming WOW Thunk Service Driver

CVE-2025-53149 — Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00703 🔬 Patch diffed 2025-08 archive

Executive Summary

Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-122: Heap-based Buffer Overflow
Released Aug 12 2025
Last Updated Aug 12 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00703 — 0.50125 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00703
probability of exploitation in the next 30 days
0.50125 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

25 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5063889 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5063889 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5063871 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5063871 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5063877 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5063877 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5063709 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5063709 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5063709 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5063709 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5063709 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5063709 (SecurityUpdate) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5063878 (Security Update) 5064010 (SecurityHotpatchUpdate) Important Elevation of Privilege 5062553 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.4946 10.0.26100.4851 Yes None Windows 11 Version 24H2 for x64-based Systems 5063878 (Security Update) 5064010 (SecurityHotpatchUpdate) Important Elevation of Privilege 5062553 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.4946 10.0.26100.4851 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 5063888 (MonthlyRollup) 5063948 (SecurityOnly) Important Elevation of Privilege 5062624 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23471 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5063888 (MonthlyRollup) 5063948 (SecurityOnly) Important Elevation of Privilege 5062624 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23471 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5063888 (MonthlyRollup) 5063948 (SecurityOnly) Important Elevation of Privilege 5062624 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23471 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5063888 (MonthlyRollup) 5063948 (SecurityOnly) Important Elevation of Privilege 5062624 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23471 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5063947 (MonthlyRollup) 5063927 (SecurityOnly) Important Elevation of Privilege 5062632 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27872 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5063947 (MonthlyRollup) 5063927 (SecurityOnly) Important Elevation of Privilege 5062632 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27872 Yes None Windows Server 2012 5063906 (MonthlyRollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5063906 (MonthlyRollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5063950 (MonthlyRollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5063950 (MonthlyRollup) Important Elevation of Privilege Yes
Windows Server 2016 5063871 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5063871 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5063877 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5063877 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5063880 (SecurityUpdate) 5063812 (SecurityHotpatchUpdate) Important Elevation of Privilege 5062572 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4052 10.0.20348.3989 Yes None Windows Server 2022 (Server Core installation) 5063880 (SecurityUpdate) 5063812 (SecurityHotpatchUpdate) Important Elevation of Privilege 5062572 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4052 10.0.20348.3989 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5063899 (SecurityUpdate) Important Elevation of Privilege Yes

Patches

8 patches
Article Type Restart
5063889 SecurityUpdate Yes
5063871 Security Update Yes
5063877 Security Update Yes
5063709 SecurityUpdate Yes
5063875 Security Update Yes
5063906 MonthlyRollup Yes
5063950 MonthlyRollup Yes
5063899 SecurityUpdate Yes

Patch Diff

ghidriff · ksthunk.sys (KB5063878)

Non-paged-pool heap overflow (CWE-122) in the Kernel Streaming WOW Thunk driver ksthunk.sys, reachable from a 32-bit (WOW64) user process via IOCTL_KS_PROPERTY. CKSThunkDevice::DispatchIoctl -> CKSAutomationThunk::ThunkPropertyIrp dispatches KS property sets (KSPROPSETID_VPConfig/VPVBIConfig); the KSPROPERTY_VPCONFIG_DDRAWSURFACEHANDLE (0xE) handler CKSAutomationThunk::HandleArrayProperty is vulnerable. In the getter path it queries the device for the element count (KsSynchronousIoControlDevice), allocates, reads the array, then copies it into SystemOutputBuffer - but OutputBufferLength is only checked against 0, not against BytesReturned/count*element_size, so a device returning more than the output buffer holds overflows the non-paged allocation. IN-HOUSE ghidriff of ksthunk.sys 10.0.26100.4768 -> .4946 (Aug 12 2025) confirms the fix: HandleArrayProperty adds a check that count*4 <= OutputBufferLength (lVar5+8) before the copy and diverts to RtlLogUnexpectedCodepath when it doesn't fit - gated behind CFR flag Feature_4034713912. Credit: aleksandr.k & voidsec (Crowdfense).

Pre-patch version 10.0.26100.4768 Download
Post-patch version 10.0.26100.4946 Download
Function Address Change Note
CKSAutomationThunk::HandleArrayProperty code change code (output-length check added, CFR-gated) Pre: getter copies the device array into SystemOutputBuffer checking OutputBufferLength only != 0. Post (Feature_4034713912): computes count*4 and requires it <= OutputBufferLength (*(uint*)(lVar5+8)); if the buffer is too small it calls RtlLogUnexpectedCodepath and does not copy. Gains a call to NTOSKRNL.EXE::RtlLogUnexpectedCodepath vs pre.
Feature_4034713912 new flag added (CFR gate) New Controlled Feature Rollout flag introduced by this patch; gates the OutputBufferLength validation in HandleArrayProperty. Both branches ship in .4946.
View full diff report View RCA report

Attack Path

A KS video-port array GET copies more device bytes than the output buffer holds, overflowing non-paged pool

Attack path for CVE-2025-53149 A KS video-port array GET copies more device bytes than the output buffer holds, overflowing non-paged pool 01 — ENTRY 32-bit (WOW64) user process issues IOCTL_KS_PROPERTY to a KS device ksthunk.sys thunks KS requests from 32-bit apps to 64-bit media drivers. CKSThunkDevice::DispatchIoctl routes usermode+wow64 property IRPs to CKSAutomationThunk::ThunkPropertyIrp. 02 — CONTROLLED INPUT Requests KSPROPSETID_VPConfig / DDRAWSURFACEHANDLE with a small output buffer (GET) The KSPROPERTY_VPCONFIG_DDRAWSURFACEHANDLE (index 0xE) item is handled by CKSAutomationThunk::HandleArrayProperty; the caller controls OutputBufferLength. 03 — PATH HandleArrayProperty asks the device for the array, allocates, and copies it into SystemOutputBuffer A first KsSynchronousIoControlDevice returns the element count/BytesReturned; a second reads the array; then the array is copied into the non-paged SystemOutputBuffer. 04 — MISSING CHECK OutputBufferLength is checked only against 0, not against the returned size The copy loop writes count*element_size bytes without verifying that fits OutputBufferLength, so a device returning more elements than the buffer holds overruns the allocation. 05 — PRIMITIVE Non-paged pool heap overflow -> elevation of privilege The copy overflows the non-paged output allocation with device-sourced bytes; groomed pool yields controlled kernel corruption. The Aug 2025 fix requires count*4 <= OutputBufferLength before copying (else RtlLogUnexpectedCodepath), gated behind CFR flag Feature_4034713912.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Aleksandr Koshelev

On This Page