CVE-2025-12053
Published: 14 January 2026
Summary
CVE-2025-12053 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Insyde (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-12053, published on 2026-01-14, is a buffer overflow vulnerability (CWE-787) affecting drivers in Insyde tool packages. These drivers use the RTL_QUERY_REGISTRY_DIRECT flag to read registry values that an untrusted user-mode application can influence, enabling a buffer overflow. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability through low-complexity means with no user interaction required. Exploitation allows high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially leading to kernel-level code execution or system compromise.
Insyde has published security advisory SA-2025010 addressing this issue. Security practitioners should consult https://www.insyde.com/security-pledge/sa-2025010/ for details on affected versions, patches, and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2571
Vulnerability details
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel driver buffer overflow directly enables exploitation for privilege escalation to achieve kernel code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of untrusted registry inputs read by drivers using RTL_QUERY_REGISTRY_DIRECT to prevent buffer overflows from user-mode influenced data.
Implements memory protections such as address space layout randomization and stack guards to mitigate buffer overflow exploits in kernel drivers even if input validation fails.
Mandates timely identification, reporting, and patching of flaws like this driver buffer overflow as addressed in Insyde's security advisory.