CVE-2025-59192 Overview
CVE-2025-59192 is a buffer over-read vulnerability in the Microsoft Windows Storport.sys storage port driver. The flaw allows an authorized local attacker to elevate privileges on affected systems. Storport is a kernel-mode driver that provides the storage port interface between SCSI miniport drivers and the Windows storage stack. Because the vulnerable code executes in kernel context, successful exploitation can result in code execution with SYSTEM privileges. The vulnerability is tracked under [CWE-126: Buffer Over-read] and affects supported Windows client and server releases from Windows 10 1507 through Windows Server 2025.
Critical Impact
A local attacker with low privileges can exploit a buffer over-read in Storport.sys to elevate to SYSTEM, compromising confidentiality, integrity, and availability of the host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2, 25H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-10-14 - CVE-2025-59192 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59192
Vulnerability Analysis
The vulnerability resides in Storport.sys, the Windows storage port driver responsible for mediating I/O between higher-level storage class drivers and vendor-supplied miniport drivers. A buffer over-read occurs when the driver reads past the end of an allocated buffer while processing input controlled by a local caller. In a kernel driver, an over-read can leak adjacent kernel memory contents back to a user-mode requester, exposing pointers, tokens, or other structures useful for defeating Kernel Address Space Layout Randomization (KASLR).
An attacker who already holds a low-privileged account on the system can chain the disclosed kernel information with a secondary primitive to achieve local privilege escalation. Microsoft classifies the outcome as elevation of privilege with high impact to confidentiality, integrity, and availability.
Root Cause
The root cause is improper validation of a length or offset field associated with a buffer processed by the Storport.sys driver. When the driver relies on an attacker-influenced size without bounding it against the allocated region, it reads memory beyond the intended boundary. This is characteristic of [CWE-126] buffer over-read defects in kernel drivers.
Attack Vector
Exploitation requires local access and low privileges. No user interaction is needed. An attacker interacts with the driver via IOCTLs or storage APIs reachable from user mode, supplies crafted input structures, and captures the over-read data returned by the driver. The primitive is then combined with additional techniques to elevate to SYSTEM.
No public proof-of-concept exploit code is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-59192
Indicators of Compromise
- Unexpected user-mode processes opening handles to storage device objects or issuing unusual DeviceIoControl calls targeting Storport-managed devices.
- Creation of new services or scheduled tasks by processes that just interacted with kernel storage interfaces, indicating post-exploitation persistence.
- Kernel crashes or BugCheck events referencing Storport.sys on hosts running unpatched builds.
Detection Strategies
- Monitor for local processes issuing anomalous IOCTL sequences to storage devices from non-administrative contexts.
- Correlate low-privileged process activity with subsequent SYSTEM-level child processes to surface privilege escalation chains.
- Track loading and version metadata of Storport.sys across the fleet to identify hosts missing the fix.
Monitoring Recommendations
- Ingest Windows Security, Sysmon, and kernel event logs into a centralized analytics platform to detect privilege transitions.
- Alert on process token elevation events where the parent process is unprivileged and the child runs as SYSTEM.
- Baseline expected callers of storage IOCTLs and flag deviations for review.
How to Mitigate CVE-2025-59192
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-59192 Advisory to all affected Windows client and server systems.
- Prioritize patching multi-user hosts, terminal servers, and systems accessible to standard users where local privilege escalation risk is highest.
- Audit local account inventories and remove unnecessary interactive logon rights to reduce the exploitable attack surface.
Patch Information
Microsoft has published a security update addressing CVE-2025-59192. Refer to the Microsoft Security Response Center advisory for the specific KB articles and build numbers corresponding to each supported Windows version. Deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or your standard patch management workflow.
Workarounds
- No vendor-supplied workaround is documented; installing the security update is the required remediation.
- Restrict local logon rights and enforce least privilege to limit which users can invoke the vulnerable code path.
- Enable attack surface reduction and application control policies to constrain execution of untrusted binaries that could stage a local exploit.
# Verify Storport.sys version on a Windows host after patching
powershell -Command "Get-Item C:\\Windows\\System32\\drivers\\storport.sys | Select-Object -ExpandProperty VersionInfo"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
