CVE-2025-53149: Windows 10 Privilege Escalation Flaw

CVE-2025-53149 Overview

CVE-2025-53149 is a heap-based buffer overflow [CWE-122] in the Microsoft Windows Kernel Streaming WOW Thunk Service Driver (ksthunk.sys). An authenticated local attacker can exploit the flaw to corrupt kernel heap memory and elevate privileges to SYSTEM. Microsoft addressed the issue in its August 2025 security updates. The vulnerability affects a broad range of Windows client and server releases, including legacy platforms such as Windows Server 2008 and modern releases such as Windows 11 24H2 and Windows Server 2025.

Critical Impact
Successful exploitation grants SYSTEM-level privileges on affected Windows hosts, enabling full compromise of confidentiality, integrity, and availability from a low-privileged user context.

Affected Products

Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2)
Windows Server 2008 SP2, Server 2008 R2 SP1, Server 2012, and Server 2012 R2
Windows Server 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-08-12 - CVE-2025-53149 published to NVD alongside Microsoft's August 2025 Patch Tuesday advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53149

Vulnerability Analysis

The Kernel Streaming WOW Thunk Service Driver (ksthunk.sys) provides 32-bit-to-64-bit thunking for Kernel Streaming I/O Control (IOCTL) requests. The driver marshals user-supplied buffers between WOW64 processes and the native kernel streaming stack. During this translation, a size calculation for an internal heap allocation is performed on attacker-influenced input without adequate bounds validation.

When the resulting buffer is populated, the driver writes past the end of the allocated pool chunk, producing a controlled heap overflow in kernel address space. Because ksthunk.sys runs at ring 0, corrupting adjacent kernel pool structures allows an attacker to pivot from a limited user context to SYSTEM. Crowdfense published a detailed root-cause analysis of the flaw (Crowdfense Vulnerability Analysis).

Root Cause

The root cause is improper validation of a length field used to size a kernel pool allocation inside the thunking routine. The driver trusts the caller-controlled size when copying marshalled data into the allocation, resulting in an out-of-bounds write. The condition maps to CWE-122: Heap-based Buffer Overflow.

Attack Vector

Exploitation requires local code execution as an authenticated, low-privileged user. The attacker opens a handle to a kernel streaming device from a 32-bit (WOW64) process and issues a crafted IOCTL through ksthunk.sys. By shaping the pool layout and overwriting an adjacent object, such as a callback pointer or object header, the attacker gains arbitrary kernel read/write and elevates to SYSTEM. No user interaction is required.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2025-53149

Indicators of Compromise

Unexpected 32-bit (WOW64) processes opening handles to kernel streaming devices such as \\.\KsecDD or \Device\KsecDD and issuing unusual IOCTLs to ksthunk.sys
Bugcheck events (BAD_POOL_HEADER, KERNEL_MODE_HEAP_CORRUPTION) originating from ksthunk.sys frames during exploitation attempts
Newly spawned SYSTEM-level processes parented by a standard user session shortly after kernel streaming activity

Detection Strategies

Hunt for low-privileged user sessions launching processes that subsequently gain SYSTEM integrity without a legitimate elevation path
Correlate Windows Error Reporting (WER) and Event ID 1001 crash dumps referencing ksthunk.sys with logon and process-creation telemetry
Deploy YARA and behavioral rules for tooling that opens Ks* device objects from WOW64 binaries outside expected media, capture, or DRM workflows

Monitoring Recommendations

Ingest Sysmon Event IDs 1 (process create), 7 (image load of ksthunk.sys consumers), and 11 (file create) into your SIEM for retrospective hunting
Track kernel-mode crash telemetry and driver-verifier findings for ksthunk.sys across the fleet
Alert on privilege-token modification patterns typical of local privilege escalation, such as token duplication from System into user processes

How to Mitigate CVE-2025-53149

Immediate Actions Required

Apply the August 2025 Microsoft security updates that address CVE-2025-53149 to all Windows client and server systems in scope
Prioritize patching of multi-user systems, terminal servers, and VDI hosts where local privilege escalation has the highest blast radius
Restrict local logon rights and enforce application allowlisting to limit which binaries can reach the vulnerable driver

Patch Information

Microsoft released fixes as part of the August 2025 Patch Tuesday cycle. Refer to the official advisory for the KB numbers and update packages that correspond to each Windows build (Microsoft Security Update).

Workarounds

No official Microsoft workaround is documented; installing the vendor patch is the supported remediation path
Reduce exposure by removing local administrative and interactive logon rights from non-essential accounts, and by disabling WOW64 on server SKUs where 32-bit applications are not required
Enable Windows Defender Application Control (WDAC) or AppLocker policies to block untrusted 32-bit binaries that could reach ksthunk.sys

bash

# Verify installation of the August 2025 cumulative update on Windows
wmic qfe list brief /format:table

# Optional: disable WOW64 subsystem on Windows Server where 32-bit apps are not needed
Disable-WindowsOptionalFeature -Online -FeatureName ServerCore-WOW64