CVE-2025-21375 Overview
CVE-2025-21375 is an elevation of privilege vulnerability in the Microsoft Windows Kernel Streaming WOW Thunk Service Driver. The flaw allows an authenticated local attacker to escalate privileges to SYSTEM on affected Windows client and server platforms. Microsoft attributes the root cause to improper input validation [CWE-20] in the driver, which processes thunking requests between 32-bit user-mode components and 64-bit kernel-mode services.
The vulnerability affects a broad range of supported Windows versions, from legacy Windows Server 2008 through Windows 11 24H2 and Windows Server 2025. Microsoft published the advisory as part of the February 2025 Patch Tuesday release.
Critical Impact
Successful exploitation grants an attacker SYSTEM-level privileges, providing full control over the compromised host, including the ability to install programs, modify or delete data, and create new accounts with full user rights.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-02-11 - CVE-2025-21375 assigned and published to NVD
- 2025-02-11 - Microsoft releases security patch via the February 2025 Patch Tuesday
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21375
Vulnerability Analysis
The vulnerability resides in the Kernel Streaming WOW Thunk Service Driver, which bridges 32-bit (WoW64) user-mode callers to the 64-bit Kernel Streaming subsystem. Windows uses this thunking layer to marshal I/O control requests, buffers, and pointers between differing address widths. Improper input validation in this translation path allows a local, authenticated attacker to submit crafted IOCTL data that the driver processes without adequate boundary or type checks.
Exploitation runs entirely from a low-privilege user context and requires no user interaction. A successful attack elevates the calling process to SYSTEM, enabling the installation of persistence mechanisms, credential theft, and lateral movement.
Root Cause
Microsoft classifies the underlying weakness as improper input validation [CWE-20] in the Kernel Streaming WOW Thunk Service Driver. Kernel-mode drivers that thunk between 32-bit and 64-bit contexts are historically prone to structure size mismatches, pointer truncation, and insufficient probe of user-supplied buffers. The driver fails to fully validate input received from user mode before acting on it in kernel context.
Attack Vector
The attack vector is local. An attacker must already possess valid low-privilege credentials on the target system, for example through a phishing payload, a compromised service account, or malicious insider access. The attacker then invokes the vulnerable driver interface from user mode to trigger the flawed thunk path and elevate to SYSTEM. No network access and no user interaction are required.
Because the flaw grants kernel-level privileges, it is well-suited as a second-stage primitive following initial access. See the Microsoft Security Update Guide advisory for vendor technical details.
Detection Methods for CVE-2025-21375
Indicators of Compromise
- Unexpected processes launched under the NT AUTHORITY\SYSTEM account whose parent process runs at medium or low integrity.
- New services, scheduled tasks, or drivers created shortly after a low-privilege process opens a handle to a Kernel Streaming device object.
- Unsigned or unusual user-mode binaries issuing DeviceIoControl calls against Kernel Streaming driver interfaces.
Detection Strategies
- Hunt for anomalous token elevation events where a non-elevated process suddenly executes child processes under SYSTEM.
- Correlate Windows kernel driver load and IOCTL activity with subsequent privileged operations such as service creation (Event ID 7045) or LSASS access.
- Baseline legitimate applications that interact with the Kernel Streaming subsystem and alert on deviations from that baseline.
Monitoring Recommendations
- Enable and forward Sysmon Event ID 1 (process create) and Event ID 10 (process access) to a central analytics platform for behavioral review.
- Monitor Windows Security Event ID 4688 for command-line evidence of privilege escalation tooling running from user profile directories.
- Track patch compliance status for the February 2025 cumulative updates across all Windows endpoints and servers.
How to Mitigate CVE-2025-21375
Immediate Actions Required
- Apply the February 2025 Microsoft security updates to every affected Windows client and server as the primary remediation.
- Prioritize patching of multi-user hosts such as Remote Desktop Session Hosts, VDI systems, and terminal servers where local access is broadly available.
- Audit local user and service account privileges to reduce the pool of accounts that could stage a local elevation attempt.
Patch Information
Microsoft addressed CVE-2025-21375 in the February 11, 2025 Patch Tuesday release. Refer to the Microsoft Security Update Guide for the specific KB numbers that apply to each Windows build. Install the update through Windows Update, WSUS, Microsoft Update Catalog, or your enterprise patch management platform, and reboot to complete driver replacement.
Workarounds
- No official vendor workaround is available; applying the security update is the only supported remediation.
- Restrict interactive and remote logon rights to trusted administrators to shrink the attack surface until patching completes.
- Enforce application allowlisting to prevent unauthorized binaries from invoking the vulnerable driver interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
