Windows Heap-Based Buffer Overflow Vulnerability Allows Attackers to Escalate Privileges
A recently patched vulnerability in a core Windows driver, identified as CVE-2025-53149, could allow a local attacker to execute code with the highest system privileges, effectively taking full control of a target machine. This flaw, a heap-based buffer overflow, was discovered in the Kernel Streaming WOW Thunk Service Driver (ksthunk.sys). Microsoft addressed the issue in its security updates released on August 12, 2025. Security researchers uncovered the vulnerability during internal analysis and reported it to Microsoft through a responsible disclosure process, leading to the development and release of a patch. The ksthunk.sys driver is essential for maintaining backwards compatibility on 64-bit versions of Windows, serving as a “thunk” layer that translates requests between different system architectures. It bridges the gap between 32-bit user-mode applications and 64-bit kernel-mode drivers that manage real-time data streams for audio and video, ensuring that legacy applications can function correctly.
The vulnerability resides in the CKSAutomationThunk::HandleArrayProperty() function of the ksthunk.sys driver (SHA-1: 68B5B527550731DD657BF8F1E8FA31E895A7F176). An attacker can exploit this flaw by sending a specially crafted request from a 32-bit application to a device using the Kernel Streaming interface. The core issue lies in how the driver handles requests to retrieve specific properties from a device, such as KSPROPSETID_VPConfig. The vulnerable code path first determines the size of the data to be returned and prepares to copy this data into an output buffer provided by the user-mode application. However, a critical validation step is missing; while the function checks that the output buffer is not empty, it fails to verify if the buffer is large enough to hold the incoming data. This oversight allows the driver to write past the boundary of the allocated buffer, resulting in a heap-based buffer overflow within the kernel’s non-paged pool. A successful exploit could enable an attacker to corrupt kernel memory and execute arbitrary code with kernel-level privileges. To trigger the vulnerability, an attacker would need to run code on a target system and make a specific DeviceIoC call.
Categories: Windows Vulnerability, Buffer Overflow, Kernel Streaming
Tags: Vulnerability, Windows, Buffer Overflow, ksthunk.sys, Kernel Streaming, Security Update, Code Execution, Privileges, Exploit, DeviceIoC