CVE-2025-64673 Overview
CVE-2025-64673 is an improper access control vulnerability in the Microsoft Storvsp.sys driver, the Storage Virtualization Service Provider used by Hyper-V. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows systems. The weakness is classified under [CWE-284: Improper Access Control].
Microsoft published the advisory on December 9, 2025 covering Windows 10, Windows 11, and Windows Server releases from 2019 through 2025. Successful exploitation grants high impact to confidentiality, integrity, and availability on the local host.
Critical Impact
A low-privileged local user can elevate to higher privileges by abusing the Storvsp.sys driver, gaining full control over affected Windows endpoints and servers.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-64673 published to NVD
- 2025-12-09 - Microsoft releases security update guidance
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64673
Vulnerability Analysis
The vulnerability resides in Storvsp.sys, the kernel-mode Storage Virtualization Service Provider driver that services virtual storage requests between the Hyper-V host and guest partitions. The driver fails to enforce proper access controls on one or more of its exposed interfaces. An authorized user on the host can interact with the driver in ways that were intended to be restricted to more privileged callers.
Because Storvsp.sys executes in kernel context, any weakness in its access checks allows code paths reachable from user mode to influence kernel-controlled resources. The result is a local elevation of privilege from a standard authenticated user to a higher privilege level, potentially SYSTEM.
Root Cause
The root cause is [CWE-284] Improper Access Control within the Storvsp.sys driver. Access decisions on driver-exposed operations are insufficient, permitting a caller without the required privilege to perform privileged actions. Microsoft has not published implementation-level details beyond the advisory.
Attack Vector
Exploitation requires local access and low privileges on the target host. No user interaction is needed. An attacker with a foothold, such as through phishing, a compromised service account, or an existing malware infection, can invoke the vulnerable driver interface to escalate privileges. See the Microsoft Security Update Guide entry for CVE-2025-64673 for vendor-specific technical context.
No public proof-of-concept or in-the-wild exploitation has been reported at the time of writing. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-64673
Indicators of Compromise
- Unexpected user-mode processes opening handles to \\.\Storvsp or issuing DeviceIoControl calls against the Storvsp.sys driver from non-virtualization workloads.
- New processes running as SYSTEM that were spawned from a standard user session shortly after driver interaction.
- Loading of Storvsp.sys on hosts where Hyper-V is not expected to be in use.
Detection Strategies
- Enable Windows kernel and driver auditing to record handle opens and IOCTLs targeting Storvsp.sys.
- Correlate token elevation events (Event ID 4672, 4688) with prior driver interaction from low-privileged users.
- Hunt for local privilege escalation behaviors mapped to MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).
Monitoring Recommendations
- Track patch compliance for the December 2025 Microsoft security updates across all Windows 10, Windows 11, and Windows Server hosts.
- Alert on integrity level transitions where a medium-integrity process launches a high or SYSTEM-integrity child without a known parent chain.
- Monitor Hyper-V hosts and Windows Server virtualization roles for anomalous storage driver activity.
How to Mitigate CVE-2025-64673
Immediate Actions Required
- Apply the December 2025 Microsoft security updates referenced in the Microsoft advisory for CVE-2025-64673 to all affected Windows client and server builds.
- Prioritize patching of Hyper-V hosts, Windows Server 2019/2022/2025 systems, and multi-user endpoints where local privilege escalation risk is highest.
- Audit local accounts and remove unnecessary interactive logon rights to reduce the exploit surface.
Patch Information
Microsoft has issued security updates for all listed Windows 10, Windows 11, and Windows Server versions. Refer to the Microsoft Security Update Guide for the specific KB numbers per build. There is no vendor-endorsed configuration workaround; the fix is delivered through the cumulative update channel.
Workarounds
- No official workaround exists. Apply the vendor patch as the primary remediation.
- Restrict local logon and RDP access to trusted administrators until patching is complete.
- Enforce application allowlisting and endpoint protection to block unknown binaries that could stage a local privilege escalation.
# Verify installed updates on Windows using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
# Check driver version for Storvsp.sys
Get-Item C:\Windows\System32\drivers\storvsp.sys | Select-Object VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
