CVE-2025-49675 Overview
CVE-2025-49675 is a use-after-free vulnerability in the Microsoft Kernel Streaming WOW Thunk Service Driver. An authenticated local attacker can exploit this flaw to elevate privileges on affected Windows systems. The vulnerability is tracked under CWE-416: Use After Free.
The issue affects a broad range of Windows client and server releases, from Windows 10 1507 through Windows 11 24H2 and from Windows Server 2008 through Windows Server 2025. Successful exploitation grants the attacker kernel-level code execution, compromising confidentiality, integrity, and availability of the host.
Critical Impact
A local attacker with standard user rights can obtain SYSTEM privileges through kernel memory corruption in the Kernel Streaming WOW Thunk Service Driver.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-07-08 - CVE-2025-49675 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49675
Vulnerability Analysis
CVE-2025-49675 resides in the Kernel Streaming WOW Thunk Service Driver, a kernel component that translates 32-bit (WOW64) user-mode requests into calls handled by the 64-bit kernel streaming subsystem. A use-after-free condition in this driver allows an attacker running local code to reference a kernel object after it has been released.
An authorized local attacker requires only low privileges and no user interaction to trigger the flaw. Because the vulnerable code runs in kernel context, successful exploitation yields full kernel-mode code execution and lateral escalation from a standard user account to SYSTEM.
The EPSS score is 0.358% with a percentile of 28.883, indicating limited public exploitation observed to date. However, kernel streaming components have a well-documented history of privilege escalation weaponization in commodity malware and post-compromise toolkits.
Root Cause
The root cause is improper object lifetime management inside the Kernel Streaming WOW Thunk Service Driver. A driver code path releases a kernel object while another path retains a dangling reference. When the stale pointer is dereferenced, the attacker-controlled contents of the reallocated memory can be used to hijack kernel execution flow.
Attack Vector
Exploitation requires local access with valid user credentials. The attacker issues crafted I/O control (IOCTL) requests to the vulnerable driver from a WOW64 (32-bit) process, racing the driver into freeing an object that is subsequently reused. No network access, elevated privileges, or user interaction is needed. See the Microsoft CVE-2025-49675 Advisory for vendor-provided technical context.
Detection Methods for CVE-2025-49675
Indicators of Compromise
- Unexpected process token elevation from a medium-integrity user process to SYSTEM without a legitimate parent path such as services.exe or wininit.exe.
- Crash dumps or bug checks referencing ksthunk.sys following IOCTL activity from 32-bit user processes.
- Anomalous handle opens against \\.\KSTHUNK or related kernel streaming device objects from unsigned or newly observed binaries.
Detection Strategies
- Hunt for local privilege escalation sequences where a low-privilege process spawns a SYSTEM-integrity child shortly after loading kernel streaming interfaces.
- Correlate WOW64 (32-bit) process activity with driver IOCTL patterns targeting ksthunk.sys, particularly rapid open-close-reopen cycles indicative of race exploitation.
- Apply behavioral rules that flag token duplication or SeDebugPrivilege acquisition immediately after kernel driver interaction.
Monitoring Recommendations
- Enable Windows kernel event tracing (ETW) for driver load and IOCTL events and forward to a centralized data lake for retrospective analysis.
- Monitor Sysmon Event ID 1 (process creation) and Event ID 10 (process access) for unusual access to lsass.exe following kernel driver interaction.
- Track patch compliance across all Windows client and server SKUs listed in the Microsoft advisory using vulnerability management tooling.
How to Mitigate CVE-2025-49675
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-49675 Advisory to all affected Windows and Windows Server systems.
- Prioritize patching multi-user systems, terminal servers, and jump hosts where local accounts are more likely to be leveraged for escalation.
- Audit local user accounts and remove unnecessary interactive logon rights to reduce the attack surface for local privilege escalation.
Patch Information
Microsoft has released updates addressing the use-after-free in the Kernel Streaming WOW Thunk Service Driver. Consult the vendor advisory for the specific KB article and build numbers applicable to each Windows version. Systems must be rebooted after installation for the updated driver to take effect.
Workarounds
- No official workaround is published by Microsoft. Patching is the primary remediation.
- Restrict execution of untrusted 32-bit (WOW64) binaries via Windows Defender Application Control or AppLocker policies until the patch is deployed.
- Enforce least-privilege on endpoints and enable attack surface reduction rules to limit exploitation opportunities for locally executed payloads.
# Verify patch status on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Inspect the vulnerable driver version
Get-Item C:\Windows\System32\drivers\ksthunk.sys | Select-Object VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
