The vulnerability of the MmMapIoSpace() function in the ThrottleBlood.sys driver allows a hacker to escalate their privileges, execute arbitrary code, or cause a service failure.

The vulnerability of the MmMapIoSpace function in the ThrottleBlood.sys driver, as part of the ThrottleStop utility, is related to open IOCTLs with insufficient access control. Exploiting this vulnerability could allow an attacker to enhance their privileges, execute arbitrary code, or cause...

CVE-2025-7771

CVE-2025-7771 Эксплойт для вызова произвольных функций режима ядра из пользовательского режима путем злоупотребления драйвером ThrottleStop. Демонстрация Ссылки https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 : Произвольное чтение/запись физической памяти и портов ввода-вывода через драйвер ThrottleStop ThrottleStop — это небольшое легитимное приложение, используемое для мониторинга и коррекции троттлинга ЦП. Оно имеет драйвер, который облегчает эти задачи, и в основном...

ThrottleStopPPL

ThrottleStopPPL Windows Server 2022 上の Protected Process Light PPL 保護レベルを管理するための概念実証ツールです。ThrottleStop ドライバの脆弱性（CVE-2025-7771）を悪用します。 概要 このツールは、ThrottleStop ドライバによって公開された任意の物理メモリ読み取り/書き込み機能を介した特権昇格を示します。カーネルメモリ構造を直接操作することで、プロセス保護レベルの変更を可能にします。 特徴 任意の物理メモリ読み取り/書き込み Superfetch を介した仮想アドレスから物理アドレスへの変...

throttlestop-exploit-rw

Маппер физической памяти Исследовательский инструмент, демонстрирующий доступ к физической памяти через трансляцию виртуальных адресов в физические в сочетании с эксплуатацией уязвимого драйвера. Обзор Этот проект исследует низкоуровневое управление памятью Windows, объединяя технику superfetch д...

Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation

Exploit Title: Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation Exploit Details: https://xavibel.com/2025/12/22/using-vulnerable-drivers-in-red-team-exercises/ Date: 8/12/2025 Exploit Author: Xavi Beltran Vendor Homepage:...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...

PT-2026-6023

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A flaw in the Windows kernel driver ProcessMonitorDriver.sys allows any user-mode application with a handle to the device to terminate arbitrary processes, including protected system processe...

EUVD-2025-23820

Malicious code in bioql PyPI...

Exploit for CVE-2025-7771

CVE-2025-7771 Minimal exploit to...

Exploit for CVE-2025-7771

CVE-2025-7771 – ThrottleStop.sys Privilege Escalation Vuln...

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

Driver of destruction: How a legitimate driver is being used to take down AV processes

Introduction In a recent incident response case in Brazil, we spotted intriguing new antivirus AV killer software that has been circulating in the wild since at least October 2024. This malicious artifact abuses the ThrottleStop.sys driver, delivered together with the malware, to terminate numero...

CVE-2025-7771 Code Execution / Escalation of Privileges in ThrottleStop

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

CVE-2025-7771 Code Execution / Escalation of Privileges in ThrottleStop

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

PT-2025-32145

Name of the Vulnerable Software and Affected Versions ThrottleStop.sys version 3.0.0.0 ThrottleStop.sys affected versions not specified Description The ThrottleStop.sys driver contains an insecure implementation of the MmMapIoSpace function, which exposes two IOCTL interfaces allowing arbitrary...

TechPowerUp ThrottleStop 安全漏洞

TechPowerUp ThrottleStop is a software for monitoring and tuning CPU performance from TechPowerUp, Inc. A security vulnerability exists in TechPowerUp ThrottleStop version 3.0.0.0 that originates from allowing physical memory reads and writes, which could result in elevated privileges...