CVE-2025-45737: Netease Neacsafe64 Privilege Escalation

CVE-2025-45737 Overview

CVE-2025-45737 is a privilege escalation vulnerability in the NetEase (Hangzhou) Network Co., Ltd NeacSafe64 driver before version v1.0.0.8. The flaw resides in the NeacSafe64.sys kernel-mode component, which exposes IOCTL (Input/Output Control) handlers that fail to enforce proper access restrictions. Attackers who can interact with the driver device can send crafted IOCTL commands to elevate privileges on the affected host. The weakness is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
Successful exploitation allows a low-privileged process to execute code or perform operations with kernel-level privileges, undermining the host security boundary.

Affected Products

NetEase NeacSafe64 Driver versions prior to v1.0.0.8
Windows systems running the NeacSafe64.sys kernel driver
Endpoints where NetEase gaming or client software has installed the vulnerable driver

Discovery Timeline

2025-06-27 - CVE-2025-45737 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-45737

Vulnerability Analysis

The NeacSafe64.sys driver registers a device object accessible from user mode. The driver exposes IOCTL handlers that perform privileged operations without adequate caller validation. A local attacker opens a handle to the driver device and issues crafted DeviceIoControl requests. The handlers process attacker-controlled input and perform kernel-level actions on behalf of the caller, resulting in privilege escalation.

Signed kernel drivers that expose powerful IOCTLs are a recurring target for Bring Your Own Vulnerable Driver (BYOVD) attacks. Adversaries load the legitimate signed driver on a target system and abuse its IOCTL surface to bypass Endpoint Detection and Response (EDR) controls or acquire SYSTEM privileges. A public proof-of-concept controller is referenced in the NeacController GitHub repository.

Root Cause

The root cause is improper privilege management in the driver's IOCTL dispatch routines. The driver does not sufficiently restrict which callers may invoke sensitive control codes and does not validate that requested operations are safe to perform on behalf of an unprivileged process. This design flaw maps to [CWE-269].

Attack Vector

Exploitation requires the ability to open the NeacSafe64 device object and issue DeviceIoControl calls. On systems where the driver is installed, this is reachable from a local user context. In BYOVD scenarios, an attacker with prior code execution can register the vulnerable driver themselves and then reach the flawed IOCTL handlers to escalate to kernel privileges.

No verified exploit code is published in NVD references. The vulnerability mechanism is described in prose because no vetted proof-of-concept snippet is available for reproduction here. Refer to the NeacController GitHub repository for the referenced research artifact.

Detection Methods for CVE-2025-45737

Indicators of Compromise

Presence of NeacSafe64.sys at versions earlier than v1.0.0.8 on endpoints not associated with NetEase gaming clients
Service or driver load events registering NeacSafe64 from unusual filesystem paths such as %TEMP% or user-writable directories
Unexpected DeviceIoControl traffic from non-NetEase processes targeting the NeacSafe64 device object

Detection Strategies

Inventory kernel drivers across the fleet and flag any instance of NeacSafe64.sys below 1.0.0.8
Alert on driver installation events (Windows Event ID 7045 and Sysmon Event ID 6) referencing NeacSafe64
Correlate driver load with subsequent token manipulation, process elevation, or handle duplication to lsass.exe

Monitoring Recommendations

Enable Microsoft's vulnerable driver blocklist and Hypervisor-Protected Code Integrity (HVCI) where supported
Log all kernel driver load events and forward them to a central Security Information and Event Management (SIEM) platform
Baseline expected driver inventories and alert on deviations, especially signed third-party drivers loaded outside their vendor's application context

How to Mitigate CVE-2025-45737

Immediate Actions Required

Update the NetEase NeacSafe64 driver to version v1.0.0.8 or later on all affected endpoints
Uninstall the driver on systems that do not require NetEase client software
Add the vulnerable driver hash to the Microsoft Recommended Driver Block Rules to prevent BYOVD reuse

Patch Information

NetEase addressed the issue in NeacSafe64 driver version v1.0.0.8. Verify the file version of NeacSafe64.sys after update using wmic datafile where name="C:\\Windows\\System32\\drivers\\NeacSafe64.sys" get Version. No vendor advisory URL is listed in the NVD record; confirm patch availability through official NetEase distribution channels.

Workarounds

Remove or disable the NeacSafe64 service where the NetEase client is not in active use
Enforce application allowlisting to prevent unprivileged users from loading arbitrary signed drivers
Deploy the Microsoft vulnerable driver blocklist through Windows Defender Application Control (WDAC) policy

bash

# Query and remove the NeacSafe64 driver service on Windows
sc.exe query NeacSafe64
sc.exe stop NeacSafe64
sc.exe delete NeacSafe64