Exploit for CVE-2025-7771

🔓 ThrottleStop.sys Kernel Exploit — HVCI-Compatible Physical M...

CVE-2025-7771

CVE-2025-7771 affects ThrottleStop.sys (v3.0.0.0 and possibly others). The driver exposes two IOCTLs (read/write physical memory) that use MmMapIoSpace with no input validation, enabling a local attacker to map arbitrary physical memory, patch the Windows kernel, and invoke kernel functions with ...

VulnCheck KEV: CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...