The vulnerability of the MmMapIoSpace() function in the ThrottleBlood.sys driver allows a hacker to escalate their privileges, execute arbitrary code, or cause a service failure.

The vulnerability of the MmMapIoSpace function in the ThrottleBlood.sys driver, as part of the ThrottleStop utility, is related to open IOCTLs with insufficient access control. Exploiting this vulnerability could allow an attacker to enhance their privileges, execute arbitrary code, or cause...

CVE-2025-7771

CVE-2025-7771 Exploit to invoke arbitrary kernel-mode functions from usermode by abusing ThrottleStop driver. Demonstration References https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 : Arbitrary physical memory and I/O port read/write via ThrottleStop driver ThrottleStop is a small legitimate application used to monitor and correct CPU throttling. It has a driver that faciliates these tasks and it mostly doesn't have any sort of input validation...

ThrottleStopPPL

ThrottleStopPPL A proof-of-concept tool for managing Protected Process Light PPL protection levels on Windows Server 2022 by exploiting vulnerabilities in the ThrottleStop driver CVE-2025-7771. Overview This tool demonstrates privilege escalation through arbitrary physical memory read/write...

throttlestop-exploit-rw

Physical Memory Mapper Research tool demonstrating physical memory access through virtual-to-physical address translation combined with vulnerable driver exploitation. Overview This project explores low-level Windows memory management by combining the superfetch technique for address translation...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 : Arbitrary physical memory and I/O port read/write via ThrottleStop driver ThrottleStop is a small legitimate application used to monitor and correct CPU throttling. It has a driver that faciliates these tasks and it mostly doesn't have any sort of input validation...

Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation

Exploit Title: Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation Exploit Details: https://xavibel.com/2025/12/22/using-vulnerable-drivers-in-red-team-exercises/ Date: 8/12/2025 Exploit Author: Xavi Beltran Vendor Homepage:...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...

PT-2026-6023

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A flaw in the Windows kernel driver ProcessMonitorDriver.sys allows any user-mode application with a handle to the device to terminate arbitrary processes, including protected system processe...

EUVD-2025-23820

Malicious code in bioql PyPI...

Exploit for CVE-2025-7771

CVE-2025-7771 Minimal exploit to...

Exploit for CVE-2025-7771

CVE-2025-7771 – ThrottleStop.sys Privilege Escalation Vuln...

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

Driver of destruction: How a legitimate driver is being used to take down AV processes

Introduction In a recent incident response case in Brazil, we spotted intriguing new antivirus AV killer software that has been circulating in the wild since at least October 2024. This malicious artifact abuses the ThrottleStop.sys driver, delivered together with the malware, to terminate numero...

CVE-2025-7771 Code Execution / Escalation of Privileges in ThrottleStop

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

CVE-2025-7771 Code Execution / Escalation of Privileges in ThrottleStop

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

TechPowerUp ThrottleStop 安全漏洞

TechPowerUp ThrottleStop is a software for monitoring and tuning CPU performance from TechPowerUp, Inc. A security vulnerability exists in TechPowerUp ThrottleStop version 3.0.0.0 that originates from allowing physical memory reads and writes, which could result in elevated privileges...

PT-2025-32145

Name of the Vulnerable Software and Affected Versions ThrottleStop.sys version 3.0.0.0 ThrottleStop.sys affected versions not specified Description The ThrottleStop.sys driver contains an insecure implementation of the MmMapIoSpace function, which exposes two IOCTL interfaces allowing arbitrary...