deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54644
Published: 2025-08-06
Description: Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125, CWE-129
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54645
Published: 2025-08-06
Description: Out-of-bounds array access issue due to insufficient data verification in the location service module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-129
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54646
Published: 2025-08-06
Description: Vulnerability of inadequate packet length check in the BLE module.
Impact: Successful exploitation of this vulnerability may affect performance.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-130
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54647
Published: 2025-08-06
Description: Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54648
Published: 2025-08-06
Description: Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54649
Published: 2025-08-06
Description: Vulnerability of using incompatible types to access resources in the location service.
Impact: Successful exploitation of this vulnerability may cause some location information attributes to be incorrect.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-843
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54650
Published: 2025-08-06
Description: Improper array index verification vulnerability in the audio codec module.
Impact: Successful exploitation of this vulnerability may affect the audio decoding function.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-129
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54651
Published: 2025-08-06
Description: Race condition vulnerability in the kernel hufs module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-6994
Published: 2025-08-06
Description: The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/reveal-directory-listing-wordpress-theme/27704330; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd00d716-535c-41eb-a766-82079e0060e6?source=cve
CVE: CVE-2025-7399
Published: 2025-08-06
Description: The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048#item-description__changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb8756b-7c0f-4bc9-9e24-07598efa9eee?source=cve
CVE: CVE-2025-7498
Published: 2025-08-06
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/trunk/assets/js/exad-scripts.js#L187; https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/trunk/assets/vendor/js/jquery.countdown.min.js; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3326867%40exclusive-addons-for-elementor&new=3326867%40exclusive-addons-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2025-8100
Published: 2025-08-06
Description: The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-open-street-map.js#L57; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/open-street-map/widgets/open-street-map.php#L498; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3339093%40bdthemes-element-pack-lite&new=3339093%40bdthemes-element-pack-lite&sfp_email=&sfph_mail=
CVE: CVE-2025-20990
Published: 2025-08-06
Description: Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21010
Published: 2025-08-06
Description: Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account.
CVSS Score: 6.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21011
Published: 2025-08-06
Description: Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21012
Published: 2025-08-06
Description: Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21013
Published: 2025-08-06
Description: Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to outdoor exercise and sleep time.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21014
Published: 2025-08-06
Description: Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21015
Published: 2025-08-06
Description: Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21016
Published: 2025-08-06
Description: Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privileged APIs.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=08
CVE: CVE-2025-21017
Published: 2025-08-06
Description: Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21018
Published: 2025-08-06
Description: Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bounds memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21019
Published: 2025-08-06
Description: Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. User interaction is required for triggering this vulnerability.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21020
Published: 2025-08-06
Description: Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21021
Published: 2025-08-06
Description: Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21022
Published: 2025-08-06
Description: Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21023
Published: 2025-08-06
Description: Improper access control in WcsExtension for Galaxy Watch prior to Android Watch 16 allows local attackers to access sensitive information.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-21024
Published: 2025-08-06
Description: Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information.
CVSS Score: 3.3 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=08
CVE: CVE-2025-7376
Published: 2025-08-06
Description: Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric GENESIS version 11.00, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95, and Mitsubishi Electric Iconics Digital Solutions GENESIS version 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the processes of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-64
References: https://jvn.jp/vu/JVNVU96364629; https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-009_en.pdf
CVE: CVE-2025-7727
Published: 2025-08-06
Description: The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3338801/; https://wordpress.org/plugins/gutenverse/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/76cfe806-a8d9-4249-b2d0-eb3a314ca69a?source=cve
CVE: CVE-2025-21452
Published: 2025-08-06
Description: Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21455
Published: 2025-08-06
Description: Memory corruption while submitting blob data to kernel space though IOCTL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21456
Published: 2025-08-06
Description: Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21457
Published: 2025-08-06
Description: Information disclosure while opening a fastrpc session when domain is not sanitized.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21458
Published: 2025-08-06
Description: Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21461
Published: 2025-08-06
Description: Memory corruption when programming registers through virtual CDM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21464
Published: 2025-08-06
Description: Information disclosure while reading data from an image using specified offset and size parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21465
Published: 2025-08-06
Description: Information disclosure while processing the hash segment in an MBN file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21472
Published: 2025-08-06
Description: Information disclosure while capturing logs as eSE debug messages are logged.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-489
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21473
Published: 2025-08-06
Description: Memory corruption when using Virtual cdm (Camera Data Mover) to write registers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21474
Published: 2025-08-06
Description: Memory corruption while processing commands from A2dp sink command queue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-21477
Published: 2025-08-06
Description: Transient DOS while processing CCCH data when NW sends data with invalid length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27062
Published: 2025-08-06
Description: Memory corruption while handling client exceptions, allowing unauthorized channel access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27065
Published: 2025-08-06
Description: Transient DOS while processing a frame with malformed shared-key descriptor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27066
Published: 2025-08-06
Description: Transient DOS while processing an ANQP message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27067
Published: 2025-08-06
Description: Memory corruption while processing DDI call with invalid buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27068
Published: 2025-08-06
Description: Memory corruption while processing an IOCTL command with an arbitrary address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27069
Published: 2025-08-06
Description: Memory corruption while processing DDI command calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27071
Published: 2025-08-06
Description: Memory corruption while processing specific files in Powerline Communication Firmware.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27072
Published: 2025-08-06
Description: Information disclosure while processing a packet at EAVB BE side with invalid header length.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27073
Published: 2025-08-06
Description: Transient DOS while creating NDP instance.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27075
Published: 2025-08-06
Description: Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-27076
Published: 2025-08-06
Description: Memory corruption while processing simultaneous requests via escape path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-47324
Published: 2025-08-06
Description: Information disclosure while accessing and modifying the PIB file of a remote device via powerline.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1230
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/august-2025-bulletin.html
CVE: CVE-2025-7954
Published: 2025-08-06
Description: A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://github.com/shopware/shopware/issues/11245; http://seclists.org/fulldisclosure/2025/Aug/17; https://github.com/shopware/shopware/issues/11245
CVE: CVE-2025-7202
Published: 2025-08-06
Description: A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights.
CWE: CWE-352
References: https://www.toreon.com/flashing-your-lights-cve-2025-7202/
CVE: CVE-2025-8556
Published: 2025-08-06
Description: A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
CVSS Score: 3.7 (LOW)
CWE: CWE-1287
References: https://access.redhat.com/security/cve/CVE-2025-8556; https://bugzilla.redhat.com/show_bug.cgi?id=2371624; https://github.com/cloudflare/circl
CVE: CVE-2025-22469
Published: 2025-08-06
Description: OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. An arbitrary OS command may be executed on the system with a certain non-administrative user privilege.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN16547726/; https://www.sato-global.com/support_notices/240830/
CVE: CVE-2025-22470
Published: 2025-08-06
Description: CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua script may be executed on the system with the root privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://jvn.jp/en/jp/JVN16547726/; https://www.sato-global.com/support_notices/240830/
CVE: CVE-2025-6013
Published: 2025-08-06
Description: Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-156
References: https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092
CVE: CVE-2025-7771
Published: 2025-08-06
Description: ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.
CWE: CWE-782
References: https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md; https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/; https://www.techpowerup.com/download/techpowerup-throttlestop/