CVE-2025-12051
Published: 14 January 2026
Summary
CVE-2025-12051 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Insyde (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-12051 is a buffer overflow vulnerability (CWE-787) in drivers within tool packages. These drivers use the RTL_QUERY_REGISTRY_DIRECT flag to read a registry value that an untrusted user-mode application may influence, triggering the overflow. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-14.
A local attacker with low privileges can exploit this issue, requiring only local access, low attack complexity, and no user interaction. Exploitation allows the untrusted user-mode application to cause a buffer overflow in the kernel-mode driver, potentially resulting in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution or system crashes.
Insyde's security advisory provides details on mitigation: https://www.insyde.com/security-pledge/sa-2025010/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2580
Vulnerability details
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in kernel driver from user-controlled registry value directly enables local privilege escalation to arbitrary kernel code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the buffer overflow vulnerability by identifying, prioritizing, and applying vendor patches to the affected drivers.
Requires the drivers to validate and bound-check registry values influenced by untrusted user-mode applications to prevent buffer overflows.
Deploys memory protections like stack canaries, DEP, and ASLR to block arbitrary code execution or corruption from the kernel driver buffer overflow.