Windows Heap Buffer Overflow Vulnerability Allows Attackers to Gain Elevated Privileges

A critical security vulnerability has been discovered in Microsoft Windows systems that allows attackers to escalate their privileges and potentially gain complete control over affected machines. The vulnerability, designated CVE-2025-53149, affects the Kernel Streaming WOW Thunk Service Driver (ksthunk.sys) and was patched by Microsoft in August 2025.

According to Crowdfense, the vulnerability is a heap-based overflow located in the CKSAAutomationThunk::HandleArrayProperty() function, triggered when processing KSPROPERTY_VPCONFIG_DDRAWSURFACEHANDLE requests and failing to validate output buffer lengths. The CVSS score is 7.8 (High). The driver acts as a bridge between 32-bit user applications and 64-bit kernel drivers, enabling privilege escalation when exploited, and a non-paged heap overflow is possible.

Disclosure followed a process that began with discovery on 14 April 2025, with Microsoft confirming the flaw on 20 May 2025 and a security bounty awarded on 4 June 2025; Microsoft released patches as part of the August 2025 Patch Tuesday.