CVE-2025-12052 egwindrv.sys is potentially vulnerable to a buffer overflow.

The drivers in the tool packages use RTLQUERYREGISTRYDIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow...

CVE-2025-12052

CVE-2025-12052 is described across multiple sources as a local-buffer-overflow vulnerability stemming from drivers in tool packages reading registry values using RTL_QUERY_REGISTRY_DIRECT. Affected component is the driver (egwindrv.sys) or related kernel/tool drivers, with the untrusted applicati...

CVE-2025-12052 egwindrv.sys is potentially vulnerable to a buffer overflow.

The drivers in the tool packages use RTLQUERYREGISTRYDIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow...