Cyber Resilience

CVE-2025-7771

Published
06 August 2025
Modified
17 June 2026
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.068 93th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-7771 is a high-severity Exposed IOCTL with Insufficient Access Control (CWE-782) vulnerability. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and…

more

invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

CWE(s)
CWE-782

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-39251Shared CWE-782
CVE-2025-15641Shared CWE-782
CVE-2026-8797Shared CWE-782
CVE-2024-33219Shared CWE-782
CVE-2024-30804Shared CWE-782
CVE-2026-57851Shared CWE-782
CVE-2025-8061Shared CWE-782
CVE-2024-33221Shared CWE-782
CVE-2025-26125Shared CWE-782
CVE-2026-8501Shared CWE-782

Affected Assets

—
ThrottleStop.sys
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V8.2.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 directly requires enforcement of access authorizations on system resources, which structurally stops an IOCTL from being exposed without proper controls.

AC-6 Least Privilege good match

AC-6 requires least-privilege assignments that limit which users or processes can reach privileged IOCTL functionality.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly enforces least-privilege access permissions on interfaces such as IOCTLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes improperly exposed IOCTL entry points.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing IOCTL authorization during development.

A.8.2 Privileged access rights partial match
prevents

Privileged access rights directly restrict who may invoke sensitive IOCTLs.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes design-time access-control requirements for device interfaces.

A.8.26 Application security requirements partial match
prevents

Application security requirements capture the need for proper IOCTL authorization.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture principles mandate least-privilege access to kernel interfaces.

A.8.28 Secure coding partial match
prevents

Secure coding practices prevent omission of access-control checks on IOCTL handlers.

References