CVE-2025-24063
ks.sys — heap-based buffer overflow in Kernel Streaming Service allows elevation of privilege
Summary
| Field | Value |
|---|---|
| Driver | ks.sys (Kernel Streaming Service) |
| Vulnerability Class | Buffer Overflow (Heap) |
| CVSS | 7.8 |
| Exploited ITW | No |
| Patch Date | May 13, 2025 |
Root Cause
Missing bounds validation in the Kernel Streaming Service driver causes a heap-based buffer overflow when processing crafted streaming requests. The overflow corrupts adjacent kernel pool objects.
Exploitation
The attacker sends crafted kernel streaming requests through the KS device interface. The heap overflow corrupts adjacent objects for SYSTEM privilege escalation.
Exploitation Primitive
Crafted KS request → heap buffer overflow
→ adjacent object corruption → SYSTEM