CVE-2025-24995
Published: 11 March 2025
Summary
CVE-2025-24995 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24995, published on 2025-03-11, is a heap-based buffer overflow vulnerability (CWE-122) in the Kernel Streaming WOW Thunk Service Driver on Microsoft Windows systems. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts from local exploitation.
A local attacker with low privileges (PR:L) can exploit this vulnerability due to low attack complexity and no user interaction required. Successful exploitation allows privilege escalation, potentially granting the attacker higher-level access on the affected system.
Microsoft's advisory provides details on mitigation and available patches; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24995 for guidance on updates and workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6349
Vulnerability details
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap buffer overflow in kernel driver directly enables privilege escalation from low-privileged context (T1068: Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the specific heap-based buffer overflow vulnerability through patching the Kernel Streaming WOW Thunk Service Driver.
Implements memory protection mechanisms like ASLR, DEP, and heap hardening that directly mitigate exploitation of heap buffer overflows.
Enforces least privilege for local low-privilege accounts, limiting the attacker's starting position and potential impact of privilege escalation.