CVE-2025-12052: Windows Driver Buffer Overflow Vulnerability

CVE-2025-12052 Overview

CVE-2025-12052 is a local buffer overflow vulnerability affecting drivers shipped in Insyde tool packages. The drivers call the Windows kernel routine RtlQueryRegistryValues with the RTL_QUERY_REGISTRY_DIRECT flag to read a registry value. Because that flag reads registry data directly into a caller-provided buffer without validating the source data size, an untrusted user-mode application that controls the target registry key can trigger an out-of-bounds write in kernel memory. The issue is tracked under [CWE-787] (Out-of-bounds Write) and is documented in Insyde Security Advisory SA-2025010.

Critical Impact
A local attacker with low privileges can corrupt kernel memory through a malicious registry value, leading to privilege escalation, code execution in kernel context, or system compromise.

Affected Products

Insyde firmware tool package drivers referenced in advisory SA-2025010
Systems on which the vulnerable Insyde utility drivers are installed
Windows hosts where an untrusted user can influence the queried registry key

Discovery Timeline

2026-01-14 - CVE-2025-12052 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12052

Vulnerability Analysis

The vulnerability stems from misuse of the Windows kernel API RtlQueryRegistryValues. When a driver passes a query table entry with the RTL_QUERY_REGISTRY_DIRECT flag, the kernel copies the registry value directly into the destination buffer supplied by the driver. The driver is responsible for ensuring the destination buffer is large enough for any possible value stored under that key.

The Insyde tool package drivers do not enforce this size constraint. If an unprivileged user creates or modifies the target registry value with data larger than the driver's fixed-size buffer, the copy operation writes past the end of that buffer inside kernel memory. This produces an out-of-bounds write in ring 0.

Successful exploitation can corrupt adjacent kernel structures, hijack control flow, or elevate the calling process to SYSTEM. The impact set includes full confidentiality, integrity, and availability loss.

Root Cause

The root cause is the use of RTL_QUERY_REGISTRY_DIRECT without the mitigating RTL_QUERY_REGISTRY_TYPECHECK flag or an explicit length check. Microsoft has documented RTL_QUERY_REGISTRY_DIRECT as unsafe for untrusted registry hives precisely because it performs no type or size validation before the write.

Attack Vector

A local, low-privileged attacker writes an oversized value to the registry key that the vulnerable Insyde driver reads on load or on IOCTL handling. When the driver subsequently queries the key, the kernel copies the attacker-controlled data into an undersized kernel buffer, producing a controllable overflow. No user interaction is required and the attack complexity is low.

No public proof-of-concept is available at the time of publication. Technical detail on the specific driver entry points and registry paths is available in the Insyde Security Advisory SA-2025010.

Detection Methods for CVE-2025-12052

Indicators of Compromise

Presence of vulnerable Insyde tool package drivers on endpoints, particularly unpatched versions referenced in SA-2025010
Unexpected registry writes by non-administrative processes to keys consumed by Insyde utility drivers
Kernel bugchecks such as BAD_POOL_HEADER, KERNEL_SECURITY_CHECK_FAILURE, or SYSTEM_SERVICE_EXCEPTION correlating with driver load events
Unsigned or newly created services and user processes issuing IOCTLs to Insyde driver device objects

Detection Strategies

Inventory installed drivers and match filenames, versions, and signing certificates against the vulnerable set listed in the Insyde advisory
Monitor for registry modifications under keys read by Insyde drivers, especially value writes with abnormally large data sizes
Alert on non-administrative user processes opening handles to Insyde driver device objects followed by kernel crashes
Correlate driver load events (Windows Event ID 7045, Sysmon Event ID 6) with subsequent privilege changes on the same host

Monitoring Recommendations

Enable kernel-mode driver telemetry and forward Sysmon events 6 and 12–14 to a central analytics platform for baseline comparison
Track process integrity level transitions to detect unexpected escalation to SYSTEM following interaction with Insyde drivers
Ingest crash dump metadata to identify recurring faults in Insyde driver modules that may indicate exploitation attempts

How to Mitigate CVE-2025-12052

Immediate Actions Required

Identify all endpoints running Insyde tool package drivers and prioritize systems accessible to untrusted local users
Apply the fixed driver versions distributed by Insyde or the OEM as soon as they are available
Restrict local logon and interactive access on affected systems to trusted administrators until patches are deployed
Add the vulnerable driver hashes to the Microsoft vulnerable driver blocklist where operationally feasible

Patch Information

Refer to the Insyde Security Advisory SA-2025010 for the list of remediated driver versions. Downstream OEMs that redistribute the Insyde tool package should provide corresponding updates. Deploy the vendor-supplied patched driver on every affected host and verify the fixed version is loaded after reboot.

Workarounds

Uninstall the Insyde tool package driver on systems where it is not required for ongoing operations
Enable Microsoft's vulnerable driver blocklist and Hypervisor-protected Code Integrity (HVCI) to prevent loading of known-bad driver versions
Apply strict ACLs on the registry keys consumed by the vulnerable driver so only SYSTEM and administrators can write values
Enforce application control (WDAC or AppLocker) to block unsigned or unauthorized user-mode binaries from issuing IOCTLs to the driver

bash

# Example: query loaded Insyde drivers and audit the target registry key ACL on Windows
driverquery /v /fo csv | findstr /I "insyde"
reg query "HKLM\SYSTEM\CurrentControlSet\Services" /s /f "insyde"
icacls "HKLM\SOFTWARE\Insyde"