CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

• CWE-782

• https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md
• https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/
• https://www.techpowerup.com/download/techpowerup-throttlestop/

Published

Aug 6, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7765A vulnerability classified as critical was found in code-pro…9.8
• CVE-2025-7766Lantronix Provisioning Manager is vulnerable to XML external…8.6
• CVE-2025-7767A vulnerability, which was classified as problematic, has be…5.4
• CVE-2025-7768Tigo Energy's Cloud Connect Advanced (CCA) device contains h…9.3
• CVE-2025-7769Tigo Energy's CCA is vulnerable to a command injection vulne…8.7
• CVE-2025-7770Tigo Energy's CCA device is vulnerable to insecure session I…8.7
• CVE-2025-7772The Malcure Malware Scanner — #1 Toolset for WordPress Malwa…6.5
• CVE-2025-7773A security issue exists within the 5032 16pt Digital Configu…8.8
• CVE-2025-7774A security issue exists within the 5032 16pt Digital Configu…8.8
• CVE-2025-7775Memory overflow vulnerability leading to Remote Code Executi…9.8
• CVE-2025-7776Memory overflow vulnerability leading to unpredictable or er…9.8
• CVE-2025-7777The mirror-registry doesn't properly sanitize the host heade…6.5