PT-2025-32815 · Microsoft · Kernel Streaming Wow Thunk Service Driver+1

Aleksandr Koshelev · Published 2025-08-12 · Updated 2026-01-19 · CVE-2025-53149

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Kernel Streaming WOW Thunk Service Driver versions prior to a patch released in September 2025

Description A heap-based buffer overflow exists in the Windows Kernel Streaming WOW Thunk Service Driver (ksthunk.sys). This issue allows an authorized attacker to elevate privileges locally, potentially gaining SYSTEM-level access. The vulnerability is related to a buffer overflow in dynamically allocated memory within the driver. Exploitation of this issue can allow an attacker to affect the system.

Recommendations Apply the patch released in September 2025 to address the vulnerability.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2025-10154

CVE-2025-53149

Affected Products

Kernel Streaming Wow Thunk Service Driver

Windows

References · 26

• 🔥 https://crowdfense.com/cve-2025-53149-windows-ksthunk-heap-overflow · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53149 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53149 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-53149 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53149 · Security Note
• https://bdu.fstec.ru/vul/2025-10154 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53149 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1naph47/top_10_trending_cves_07092025 · Reddit Post
• https://t.me/defcon_news/131764 · Telegram Post
• https://twitter.com/_r_netsec/status/1971556138459230614 · Twitter Post
• https://twitter.com/autumn_good_35/status/1963900028105453808 · Twitter Post
• https://twitter.com/_r_netsec/status/1963651546962694619 · Twitter Post
• https://t.me/RNetsec/21961 · Telegram Post
• https://t.me/defcon_news/131761 · Telegram Post
• https://twitter.com/CyberWarship/status/1965409866949755224 · Twitter Post