CVE-2025-12051: Windows Driver Buffer Overflow Vulnerability

CVE-2025-12051 Overview

CVE-2025-12051 is a local buffer overflow vulnerability affecting drivers shipped in Insyde tool packages. The drivers use the RTL_QUERY_REGISTRY_DIRECT flag to read a registry value, allowing an untrusted user-mode application to trigger an out-of-bounds write in kernel memory. The flaw is classified as an out-of-bounds write [CWE-787]. A local attacker with low privileges can exploit this issue to corrupt kernel memory, leading to privilege escalation or kernel-mode code execution. Insyde published Security Advisory SA-2025010 to track this issue.

Critical Impact
Local low-privileged users can corrupt kernel memory through a vulnerable Insyde driver, with potential to escalate privileges to SYSTEM and compromise system integrity, confidentiality, and availability.

Affected Products

Insyde tool package drivers (see Insyde Security Advisory SA-2025010 for affected versions)
Systems with the vulnerable Insyde drivers installed
Windows endpoints running Insyde firmware tooling

Discovery Timeline

2026-01-14 - CVE-2025-12051 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12051

Vulnerability Analysis

The vulnerability resides in Windows kernel drivers bundled with Insyde tool packages. These drivers call the RtlQueryRegistryValues API and pass query table entries that include the RTL_QUERY_REGISTRY_DIRECT flag. This flag instructs the kernel to write the registry value directly into a caller-supplied buffer.

When RTL_QUERY_REGISTRY_DIRECT is used without combining it with RTL_QUERY_REGISTRY_TYPECHECK, the kernel does not validate the type or size of the data being copied. An attacker who can influence the registry value being queried can supply data larger than the receiving buffer, producing an out-of-bounds write into kernel memory.

The out-of-bounds write occurs in kernel context, so a successful exploit corrupts adjacent kernel structures. Attackers commonly leverage such primitives to overwrite function pointers, token fields, or callback tables to achieve SYSTEM privileges.

Root Cause

The root cause is unsafe use of the RTL_QUERY_REGISTRY_DIRECT flag without the RTL_QUERY_REGISTRY_TYPECHECK companion flag. Microsoft has documented this exact pattern as dangerous since Windows 8, but legacy drivers continue to use it. The vulnerable drivers trust that the registry value matches the expected type and size, with no validation performed before the copy.

Attack Vector

Exploitation requires local access and low privileges. An attacker must be able to control the registry value the driver reads, which typically requires write access to the relevant registry key. On systems where registry permissions are misconfigured, or where the attacker has already obtained limited privileges, this becomes a viable kernel-mode escalation path. No user interaction is required, and the attack runs entirely within the local system.

The vulnerability is described in prose only because no public proof-of-concept exploit code is available. Technical details are provided in the Insyde Security Advisory SA-2025010.

Detection Methods for CVE-2025-12051

Indicators of Compromise

Unexpected loading of Insyde tool package drivers by non-administrative processes
Kernel crashes or bugchecks referencing the affected Insyde driver image
Registry modifications to keys queried by Insyde drivers from low-privileged user contexts
Anomalous handles opened to Insyde driver device objects by untrusted user-mode processes

Detection Strategies

Monitor driver load events (Windows Event ID 6 in Sysmon) for Insyde tool package drivers and correlate with the loading process integrity level
Inspect registry write operations targeting keys read by the vulnerable drivers, especially writes performed by non-administrative users
Hunt for IOCTL traffic to Insyde driver device objects originating from unexpected user-mode binaries

Monitoring Recommendations

Enable Windows Defender Application Control or WDAC vulnerable driver blocklist policies to detect known-vulnerable driver hashes
Forward kernel bugcheck and driver load telemetry to a SIEM for correlation with privilege escalation indicators
Track creation of services or scheduled tasks that install or invoke Insyde drivers outside of authorized firmware-update workflows

How to Mitigate CVE-2025-12051

Immediate Actions Required

Apply updated drivers from Insyde once available per the Insyde Security Advisory SA-2025010
Remove or uninstall Insyde tool packages from systems where firmware management tooling is not required
Restrict access to the driver device objects to administrative users only
Add the vulnerable driver hashes to the Microsoft Vulnerable Driver Blocklist

Patch Information

Insyde has published Security Advisory SA-2025010 with patched driver versions. Refer to the Insyde Security Advisory SA-2025010 for affected versions, fixed builds, and update procedures. Deploy the fixed driver packages through standard endpoint management tooling and verify the updated driver versions on each host.

Workarounds

Uninstall the Insyde tool packages from endpoints that do not need them, removing the driver entirely
Enable the Microsoft Vulnerable Driver Blocklist via Windows Security or WDAC policy to prevent the vulnerable driver from loading
Apply strict registry ACLs on keys read by the affected drivers to prevent low-privileged users from controlling the queried values

bash

# Enable Microsoft Vulnerable Driver Blocklist (PowerShell, Administrator)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config" `
    -Name "VulnerableDriverBlocklistEnable" -Value 1 -Type DWord

# Verify Insyde driver presence on the host
Get-WmiObject Win32_SystemDriver | Where-Object { $_.Manufacturer -like "*Insyde*" }

# Remove a specific Insyde driver service after uninstalling the tool package
sc.exe delete <InsydeDriverServiceName>