CVE-2025-7771: ThrottleStop.sys Privilege Escalation

CVE-2025-7771 Overview

CVE-2025-7771 affects ThrottleStop.sys, a legitimate signed Windows driver distributed with TechPowerUp's ThrottleStop utility. The driver exposes two IOCTL interfaces that pass user-supplied addresses to MmMapIoSpace, granting unrestricted read and write access to physical memory. A local user-mode process can invoke these interfaces to patch kernel code, modify kernel data structures, and invoke arbitrary kernel routines with ring-0 privileges. The flaw enables privilege escalation, disabling of endpoint security products, and other Bring Your Own Vulnerable Driver (BYOVD) attacks. Version 3.0.0.0 and possibly earlier releases are affected. This weakness is classified under [CWE-782: Exposed IOCTL with Insufficient Access Control].

Critical Impact
Local attackers can obtain arbitrary kernel code execution, disable antivirus and EDR agents, and bypass kernel-level protections on any Windows host where the driver is loaded.

Affected Products

TechPowerUp ThrottleStop ThrottleStop.sys version 3.0.0.0
Prior versions of ThrottleStop.sys may also be affected
Any Windows system where a vulnerable ThrottleStop driver is installed or side-loaded

Discovery Timeline

2025-08-06 - CVE-2025-7771 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7771

Vulnerability Analysis

ThrottleStop.sys is a kernel-mode driver used to expose CPU performance controls to a user-mode application. The driver registers a device object reachable by any process with a handle to it and exposes two IOCTL codes that accept a physical address and length from the caller. The driver then invokes MmMapIoSpace to map that physical range into the kernel address space and returns a read or write result to the caller. Because the driver performs no validation of the requested address range and no caller access checks beyond the ability to open the device, a local attacker can read or write any location in physical memory, including kernel code pages, page tables, and process token structures.

Once arbitrary physical memory access is available, attackers escalate to full kernel code execution by locating and patching kernel functions, overwriting EPROCESS.Token fields to elevate a process to SYSTEM, or hijacking pointers used by legitimate kernel routines. The Securelist analysis of AV killer activity abusing ThrottleStop.sys documents in-the-wild use of the driver to terminate endpoint protection processes.

Root Cause

The root cause is an insecure driver design in which physical memory mapping primitives are exposed through IOCTLs without authorization checks or address validation. MmMapIoSpace is intended for device drivers that need to map memory-mapped I/O regions belonging to hardware they own. Exposing it to arbitrary callers with attacker-controlled parameters violates the kernel's isolation boundary between user mode and ring-0.

Attack Vector

Exploitation requires local access and the ability to load or reuse the signed ThrottleStop.sys driver. In BYOVD scenarios, attackers who have gained administrative rights on a host install the legitimate signed driver themselves, then open its device object and issue the vulnerable IOCTLs from a user-mode helper. Because the driver is signed by a legitimate vendor, it satisfies Windows driver signing requirements and can be loaded on systems that would otherwise block unsigned kernel modules. Technical exploitation details are documented in the Kaspersky ICS CERT advisory K-TechPowerUp-2025-001.

The vulnerability manifests when a caller sends one of the two exposed IOCTLs with a chosen physical address. The driver maps that range and performs the requested read or write, returning results to user mode without further checks. See the referenced advisory for the specific IOCTL codes and structure layouts.

Detection Methods for CVE-2025-7771

Indicators of Compromise

Presence of ThrottleStop.sys on hosts where the ThrottleStop utility is not authorized software
Service or driver registration events (System event log IDs 7045 and 7036) referencing ThrottleStop
Unexpected CreateFile handles opened against the \\.\ThrottleStop device object by non-ThrottleStop processes
Endpoint protection services terminating unexpectedly shortly after driver load

Detection Strategies

Alert on installation of ThrottleStop.sys in environments where the parent application is not on an approved software list
Hunt for processes other than the official ThrottleStop.exe opening handles to the driver's device object
Correlate driver load events with subsequent tampering of security agent processes or services
Apply the Microsoft Vulnerable Driver Blocklist and monitor for blocked-load events that indicate attempted BYOVD activity

Monitoring Recommendations

Ingest Windows System and Security logs, Sysmon driver-load events (Event ID 6), and EDR telemetry into a centralized data lake for correlation
Continuously inventory loaded kernel modules across the fleet and flag deviations from an approved driver baseline
Monitor for tampering with endpoint protection services, unexpected SYSTEM-level process creation, and modifications to protected registry keys

How to Mitigate CVE-2025-7771

Immediate Actions Required

Remove ThrottleStop.sys from all systems where the ThrottleStop utility is not required
Enable Microsoft's Vulnerable Driver Blocklist (HVCI and the Windows Defender Application Control driver blocklist) to prevent loading of known vulnerable versions
Restrict local administrator rights so that unauthorized users cannot install or register kernel drivers
Review endpoint telemetry for prior loads of the driver on production hosts

Patch Information

No fixed version is listed in the NVD record at time of writing. Apply updates per vendor instructions from the TechPowerUp ThrottleStop download page as they become available. Until a patched driver ships, treat all shipped versions of ThrottleStop.sys including 3.0.0.0 as vulnerable and block them at the kernel loader.

Workarounds

Enable Hypervisor-Protected Code Integrity (HVCI) and Memory Integrity to reduce the impact of kernel memory patching
Configure Windows Defender Application Control (WDAC) with a policy that denies loading of ThrottleStop.sys by hash or file attribute
Apply the Microsoft recommended driver block rules via DriverSiPolicy.p7b and validate enforcement with CiTool on managed endpoints
Remove local administrator privileges from standard user accounts to prevent driver installation

bash

# Example WDAC deny rule fragment for ThrottleStop.sys
# Merge into an existing WDAC policy XML and deploy via Group Policy or Intune
<FileRules>
  <Deny ID="ID_DENY_THROTTLESTOP_SYS"
        FriendlyName="Deny ThrottleStop.sys (CVE-2025-7771)"
        FileName="ThrottleStop.sys"
        MinimumFileVersion="65535.65535.65535.65535" />
</FileRules>