CVE-2025-7771
Code Execution / Escalation of Privileges in ThrottleStop
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Code Execution / Escalation of Privileges in ThrottleStop
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
- Record
CVE-2025-7771- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-782
- Updated
- 2026-11-02
EUVDEUVD-2025-23820
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
- Record
EUVD-2025-23820- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f8p7-vvxp-hcxv
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and...
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
- Record
GHSA-f8p7-vvxp-hcxv- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-782
- Updated
- 2026-11-02
NVD
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
- Record
CVE-2025-7771- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-782
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation | 2026-04-22 |
| PoC in GitHub | AmrHuss/throttlestop-exploit-rw | 2025-11-13 |
| PoC in GitHub | D4rkks/CVE-2025-7771-Vulnerability-Exploration | 2026-04-17 |
| PoC in GitHub | DeathShotXD/0xKern3lCrush | 2026-02-04 |
| PoC in GitHub | Demoo1337/ThrottleStop | 2025-09-07 |
| PoC in GitHub | Gabriel-Lacorte/CVE-2025-7771 | 2025-10-03 |
| PoC in GitHub | datcathuh/CiGaslight | 2026-10-21 |
| PoC in GitHub | datcathuh/driver-mapper | 2026-10-23 |
| PoC in GitHub | enessakircolak/CVE-2025-7771 | 2026-08-10 |
| PoC in GitHub | lzty/CVE-2025-7771 | 2026-01-21 |
Show 5 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mein-0/cve-2025-7771 | 2026-05-23 |
| PoC in GitHub | v31l0x1/ThrottleStopPPL | 2025-12-31 |
| PoC in GitHub | wqsv/ThrottleStopPoC | 2025-08-31 |
| PoC in GitHub | xM0kht4r/CVE-2025-7771 | 2026-01-13 |
| PoC in GitHub | yulisec/CVE-2025-7771 | 2026-09-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-7771 is a high vulnerability (CVSS 8.7) in Techpowerup Throttlestop, published August 6, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.30%, the 94th percentile. No source names a fixed version.