CVE-2025-24995
Published: 11 March 2025
Summary
CVE-2025-24995 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 43.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific heap-based buffer overflow vulnerability through patching the Kernel Streaming WOW Thunk Service Driver.
Implements memory protection mechanisms like ASLR, DEP, and heap hardening that directly mitigate exploitation of heap buffer overflows.
Enforces least privilege for local low-privilege accounts, limiting the attacker's starting position and potential impact of privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local heap buffer overflow in kernel driver directly enables privilege escalation from low-privileged context (T1068: Exploitation for Privilege Escalation).
NVD Description
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2025-24995, published on 2025-03-11, is a heap-based buffer overflow vulnerability (CWE-122) in the Kernel Streaming WOW Thunk Service Driver on Microsoft Windows systems. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts from local exploitation.
A local attacker with low privileges (PR:L) can exploit this vulnerability due to low attack complexity and no user interaction required. Successful exploitation allows privilege escalation, potentially granting the attacker higher-level access on the affected system.
Microsoft's advisory provides details on mitigation and available patches; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24995 for guidance on updates and workarounds.
Details
- CWE(s)