Heap-based buffer overflow in Windows Kernel-Mode Drivers

CVE-2025-24066 is a heap-based buffer overflow in the Windows Kernel Streaming Service Driver, tracked by Microsoft as an Elevation of Privilege issue. The practical outcome is kernel memory corruption that can let a local, already-authorized attacker move from a normal user context to SYSTEM. Microsoft lists a broad Windows footprint: older Windows 10 builds through current Windows 11 and Server releases were affected until their March 11, 2025 security updates, including build floors such as 19045 < 19045.5608, 22631 < 22631.5039, 20348 < 20348.3328, and 26100 < 26100.3476.

Vendor HIGH 7.8 is technically defensible in CVSS terms, but it overshoots enterprise patch urgency in the real world. The big friction point is attacker position: this bug is local-only and requires PR:L, which means it does not create initial access and it does not expand internet exposure. That makes it dangerous as ransomware/post-exploitation glue, but not something that should displace remotely reachable or actively exploited issues at the top of a 10,000-host queue.

Why this verdict

• Downgrade for foothold requirement: AV:L + PR:L means the attacker must already be on the box with a real user context. That is not initial access; it is post-compromise amplification.
• Downgrade for exposure population: the vulnerable component lives on a very large Windows estate, but the *reachable* population is only the subset where an attacker already has local code execution. EDR, allowlisting, mail controls, and browser defenses should stop many intrusions before this CVE enters play.
• Downgrade for threat signal: no KEV listing, no authoritative active exploitation signal, and a very low supplied EPSS all argue against emergency-tier prioritization.
• Hold above LOW because impact is real: if exploited successfully, this is a kernel-to-SYSTEM jump with strong follow-on value for ransomware and lateral movement prep.
• Hold above LOW because prevalence is broad: the affected footprint spans mainstream Windows client and server builds, so patching still buys meaningful risk reduction across a large estate.

Why not higher?

There is no network path, no unauthenticated reachability, and no evidence in the reviewed sources that operators are using this in the wild. A vulnerability that needs prior local execution should not outrank remotely exploitable, externally exposed, or KEV-listed issues just because the post-exploit impact is severe.

Why not lower?

This is still kernel-level memory corruption in a widely deployed platform, not a cosmetic bug. Once an attacker has a foothold, converting it into SYSTEM can materially worsen containment, enable credential theft, and accelerate domain-wide damage if the host holds privileged access.

1. Prioritize admin-tier and server patching first — Even with a MEDIUM verdict, focus the remediation window on systems where a SYSTEM jump is most valuable: admin workstations, jump boxes, terminal servers, VDI masters, and application servers. There is no mitigation SLA — go straight to the 365-day remediation window, but do not leave privileged tiers until the end of that window.
2. Reduce low-priv execution paths — Tighten application control, script restrictions, and user write/execute locations so attackers struggle to obtain the local foothold this bug requires. For a MEDIUM finding there is no mitigation SLA, so use the remediation period to shrink exploit preconditions rather than inventing emergency change activity.
3. Harden credential exposure on endpoints — Enable or verify Credential Guard, LSA protection, PAW/PAM controls, and admin tier separation so a single SYSTEM compromise yields less reusable access. This matters because the business risk of this CVE is mostly what happens *after* local privilege escalation.
4. Watch for post-escalation behavior — Tune EDR detections for token abuse, LSASS access, security tool tampering, suspicious service creation, and unusual child processes from user-space launch points. You are unlikely to catch the exact kernel bug trigger consistently, but you can catch the operator immediately after they land SYSTEM.

Run this on the target Windows host or through your remote management channel such as WinRM, MECM, or Intune script execution. Invoke it with powershell -ExecutionPolicy Bypass -File .\Test-CVE-2025-24066.ps1; standard user rights are usually enough because it only reads local OS version data from the registry.

# Test-CVE-2025-24066.ps1

# Checks whether the current Windows build is below the fixed build for CVE-2025-24066.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'

function Get-OsBuildInfo {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $build = [int]$cv.CurrentBuildNumber
    $ubr = [int]$cv.UBR
    $product = [string]$cv.ProductName
    $displayVersion = [string]$cv.DisplayVersion
    return [pscustomobject]@{
        Product        = $product
        DisplayVersion = $displayVersion
        Build          = $build
        UBR            = $ubr
        FullVersion    = "$build.$ubr"
    }
}

function Get-FixedUBR([int]$build) {
    switch ($build) {
        10240 { return 20947 }   # Windows 10 1507

        14393 { return 7876 }    # Windows 10/Server 2016 1607

        17763 { return 7009 }    # Windows 10/Server 2019 1809

        19044 { return 5608 }    # Windows 10 21H2

        19045 { return 5608 }    # Windows 10 22H2

        20348 { return 3328 }    # Windows Server 2022

        22621 { return 5039 }    # Windows 11 22H2

        22631 { return 5039 }    # Windows 11 23H2

        25398 { return 1486 }    # Windows Server 2022 23H2 (Server Core)

        26100 { return 3476 }    # Windows 11/Server 2025 24H2

        default { return $null }
    }
}

try {
    $os = Get-OsBuildInfo
    $fixedUbr = Get-FixedUBR -build $os.Build

    if ($null -eq $fixedUbr) {
        Write-Output "UNKNOWN - Unmapped Windows build $($os.FullVersion) ($($os.Product) $($os.DisplayVersion)) for CVE-2025-24066 check"
        exit 2
    }

    if ($os.UBR -lt $fixedUbr) {
        Write-Output "VULNERABLE - Current build $($os.FullVersion) is below fixed build $($os.Build).$fixedUbr for CVE-2025-24066"
        exit 1
    }
    else {
        Write-Output "PATCHED - Current build $($os.FullVersion) meets or exceeds fixed build $($os.Build).$fixedUbr for CVE-2025-24066"
        exit 0
    }
}
catch {
    Write-Output "UNKNOWN - Error while checking CVE-2025-24066: $($_.Exception.Message)"
    exit 3
}

Sources

1. Microsoft Security Update Guide - CVE-2025-24066
2. Microsoft CSAF advisory JSON - CVE-2025-24066
3. NVD entry - CVE-2025-24066
4. OpenCVE aggregated record - CVE-2025-24066
5. CISA weekly vulnerability bulletin for March 10, 2025
6. CISA Known Exploited Vulnerabilities Catalog
7. Zero Day Initiative - March 2025 Security Update Review
8. Microsoft Support - KB5053602 (Windows 11 22H2/23H2 fixed builds)