PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver – CVE-2025-53149

crowdfense.com | vulnerability | High | CVE-2025-53149 | #windows-kernel | #patch-analysis | #cve-2025-53149 | #ksthunk | #heap-overflow | #driver-vulnerability | #kernel-streaming
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Technical deep-dive into CVE-2025-53149, a heap-based buffer overflow in the Windows Kernel Streaming WOW Thunk Service driver (ksthunk.sys).
CVE
CVE-2025-53149
CVSS
7.8
Published
Collected

Related coverage

Medium · vulnerability · crowdfense.com
NT OS Kernel Information Disclosure Vulnerability – CVE-2025-53136
Analysis of CVE-2025-53136, a Windows kernel address leak introduced by the CVE-2024-43511 patch: a race condition in RtlSidHashInitialize leaks kernel pointers usable to defeat KASLR.
vulnerability · theori.io
Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)
How Theori found and reliably exploited CVE-2023-28218, a heap overflow in Windows' afd.sys Fast I/O path, turning wild copy with user fault handling into a kernel exploit, detailed at Hexacon 2023.
vulnerability · crowdfense.com
Windows AppLocker Driver LPE Vulnerability – CVE-2024-21338
In-depth analysis of CVE-2024-21338, an untrusted pointer dereference in Windows' appid.sys (AppLocker) driver enabling kernel privilege escalation, covering root cause, SMEP/kCFG bypasses and POCs.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM
Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)
Part two of the chain: how CVE-2023-21674, a use-after-free in the Windows NT kernel involving ALPC, was exploited to escape the Chrome sandbox — the year’s first in-the-wild kernel bug.
vulnerability · theori.io
Patch Analysis of CVE-2016–0189
Diffing MS16-051 to dissect CVE-2016-0189, the Internet Explorer scripting-engine flaw used in South Korean targeted attacks: a missing SafeArray lock plus a policy bypass, rebuilt into a PoC exploit.
Back