CVE-2025-67246
Published: 15 January 2026
Summary
CVE-2025-67246 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Ludashi Ludashi Driver. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 5.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-67246 is a local information disclosure vulnerability in the Ludashi driver versions prior to 5.1025. The issue stems from inadequate access control in the IOCTL handler, which exposes a device interface accessible to normal users. This handler processes attacker-controlled structures containing physical addresses in the lower 4GB range, maps arbitrary physical memory using MmMapIoSpace, and copies data back to user mode without verifying the caller's privileges or the target address validity. The vulnerability is rated with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and is associated with CWE-269 (Improper Privilege Management) and CWE-732 (Incorrect Permission Assignment for Critical Resource).
A local attacker with low privileges can exploit this vulnerability by sending crafted IOCTL requests to the driver. This enables reading arbitrary physical memory, potentially exposing kernel data structures, kernel pointers, security tokens, and other sensitive information. Such disclosure can bypass Kernel Address Space Layout Randomization (KASLR) and serve as a foundation for local privilege escalation.
Mitigation involves updating the Ludashi driver to version 5.1025 or later. Additional details are available in advisories and resources at http://ludashi.com, https://github.com/CDipper/CVE-2025-67246, and https://github.com/CDipper/CVE-Publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2755
Vulnerability details
A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver exposes a device interface accessible to a normal user and handles attacker-controlled structures containing the…
more
lower 4GB of physical addresses. The handler maps arbitrary physical memory via MmMapIoSpace and copies data back to user mode without verifying the caller's privileges or the target address range. This allows unprivileged users to read arbitrary physical memory, potentially exposing kernel data structures, kernel pointers, security tokens, and other sensitive information. This vulnerability can be further exploited to bypass the Kernel Address Space Layout Rules (KASLR) and achieve local privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local physical memory read via vulnerable IOCTL directly enables credential/token exposure (T1003), serves as KASLR bypass and foundation for LPE (T1068), and matches exploitation for credential access (T1212).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access-control checks on the IOCTL handler before MmMapIoSpace is called on attacker-supplied physical addresses.
Requires the driver to operate under least privilege so that normal user processes cannot invoke privileged memory-mapping IOCTLs.
Logically restricts access to the exposed device interface that the driver registers for arbitrary physical-memory reads.