CVE-2025-65001 Overview
CVE-2025-65001 is a high-severity vulnerability in the Fujitsu fbiosdrv.sys kernel driver affecting versions prior to 2.5.0.0. The flaw allows a local attacker with high privileges to compromise system confidentiality, integrity, and availability. The issue is classified under CWE-787 as an out-of-bounds write. Because fbiosdrv.sys runs in kernel mode, successful exploitation can affect resources beyond the driver's original security scope, resulting in a scope change on the host.
Critical Impact
Local attackers with elevated privileges can leverage the vulnerable driver to write out-of-bounds in kernel memory, potentially achieving full system compromise.
Affected Products
- Fujitsu fbiosdrv.sys kernel driver versions before 2.5.0.0
- Fujitsu client systems shipping the vulnerable BIOS driver component
- Endpoints where the driver is installed as part of Fujitsu firmware management utilities
Discovery Timeline
- 2025-11-12 - CVE-2025-65001 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-65001
Vulnerability Analysis
The vulnerability resides in fbiosdrv.sys, a Fujitsu kernel-mode driver used to interact with BIOS-level functionality on Fujitsu systems. The driver contains an out-of-bounds write condition ([CWE-787]) that permits memory to be written past the bounds of an allocated buffer. Because the code executes in Ring 0, writing outside the intended buffer can corrupt kernel structures, escalate privileges, or destabilize the operating system. The attack requires local access and existing high privileges, but the scope change component indicates the driver can be used to affect resources managed by a separate security authority, such as the kernel itself. Additional analysis of driver-level bugs in this class is discussed in the Ydinkin Substack Analysis.
Root Cause
The root cause is improper validation of input data supplied to the driver through its device I/O control (IOCTL) interface. When the driver processes attacker-controlled buffers without adequate bounds checking, it writes beyond the target buffer. This class of defect commonly stems from missing length validation on METHOD_NEITHER or METHOD_BUFFERED IOCTLs, or from trusting user-supplied offsets and sizes when copying data into kernel structures.
Attack Vector
Exploitation requires local access to a system where fbiosdrv.sys is loaded. An authenticated user with high privileges opens a handle to the driver's device object and issues a crafted IOCTL that triggers the out-of-bounds write. The write can corrupt adjacent kernel objects to achieve arbitrary kernel-mode code execution, elevate the attacker to SYSTEM, or disable security mechanisms. Refer to the Fujitsu Security Notice for vendor-provided technical context.
No public proof-of-concept exploit is currently referenced in the enriched data. The vulnerability mechanism is described in prose because verified exploit code has not been released.
Detection Methods for CVE-2025-65001
Indicators of Compromise
- Unexpected loading of fbiosdrv.sys by non-Fujitsu utilities or from non-standard paths
- Kernel bugchecks (BSOD) with stop codes such as SYSTEM_SERVICE_EXCEPTION or KERNEL_MODE_HEAP_CORRUPTION referencing fbiosdrv.sys
- Processes opening handles to the fbiosdrv device object without a legitimate BIOS-management use case
Detection Strategies
- Inventory endpoints for fbiosdrv.sys and compare file versions against the fixed release 2.5.0.0
- Monitor for CreateFile calls targeting the driver's device namespace originating from unexpected user-mode processes
- Alert on IOCTL calls to fbiosdrv.sys issued by processes that are not part of the Fujitsu management software suite
Monitoring Recommendations
- Enable kernel driver load auditing via Windows Event ID 6 in the Sysmon channel to track driver loads and signatures
- Correlate driver telemetry with privilege-escalation indicators, such as new SYSTEM-level processes spawned shortly after driver interaction
- Retain kernel crash dumps for forensic review to identify exploitation attempts against fbiosdrv.sys
How to Mitigate CVE-2025-65001
Immediate Actions Required
- Update fbiosdrv.sys to version 2.5.0.0 or later on all affected Fujitsu systems
- Restrict local administrative access on endpoints running the vulnerable driver until patching is complete
- Add the vulnerable driver hash to the Microsoft vulnerable driver blocklist where operationally feasible
Patch Information
Fujitsu addresses the vulnerability in fbiosdrv.sys version 2.5.0.0. Administrators should obtain the updated driver from the Fujitsu Security Notice and validate deployment across all affected assets.
Workarounds
- Uninstall the Fujitsu BIOS management utility on systems that do not require it, removing fbiosdrv.sys from the kernel
- Deny load access to the driver using Windows Defender Application Control (WDAC) policies that block the vulnerable version hash
- Enforce least privilege so that non-administrative users cannot open handles to the driver's device object
# Verify installed fbiosdrv.sys version on Windows endpoints
Get-Item C:\Windows\System32\drivers\fbiosdrv.sys | Select-Object VersionInfo
# Block the vulnerable driver via Microsoft Recommended Driver Block Rules (WDAC)
# See: https://learn.microsoft.com/windows/security/application-security/application-control/microsoft-recommended-driver-block-rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
