CVE-2025-12052
Published: 14 January 2026
Summary
CVE-2025-12052 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Insyde (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-12052 is a buffer overflow vulnerability (CWE-787) affecting drivers in tool packages. These drivers use the RTL_QUERY_REGISTRY_DIRECT flag to read a registry value that an untrusted user-mode application can influence, potentially triggering the overflow. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-14T02:15:49.873.
A local attacker with low privileges (PR:L) can exploit this issue with low complexity and no user interaction required. By controlling the relevant registry value from a user-mode application, the attacker can cause a buffer overflow in the driver, potentially achieving high-impact effects such as unauthorized data access (C:H), system integrity modification (I:H), and denial of service (A:H), including possible kernel-level code execution.
Mitigation details are provided in the vendor advisory at https://www.insyde.com/security-pledge/sa-2025010/. Security practitioners should consult this reference for patching instructions and workarounds specific to the affected tool packages.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2572
Vulnerability details
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in kernel driver triggered by user-controlled registry value directly enables local privilege escalation to kernel code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of untrusted registry inputs read by drivers using RTL_QUERY_REGISTRY_DIRECT to prevent buffer overflows from oversized or malformed data.
Implements memory protections like DEP and ASLR to mitigate exploitation of buffer overflows in kernel drivers even if invalid input causes an overflow.
Directly addresses the specific buffer overflow flaw by requiring identification, reporting, and patching of the vulnerable drivers as per the vendor advisory.