Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2025-7771 EUVD-2025-23820GHSA-f8p7-vvxp-hcxv

Code Execution / Escalation of Privileges in ThrottleStop

Published Aug 6, 2025 · Updated Aug 6, 2025 · Assigned by Kaspersky

Vendor: TechPowerUp Product: ThrottleStop

Description

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

Affected products

VendorProductAffectedFixed
TechPowerUp ThrottleStop 3.0.0.0 and possibly others —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 14 repositories · most starred shown

  • DeathShotXD/0xKern3lCrush ★ 61 · Feb 4, 2026

    Advanced PoC & Research for CVE-2026-0828 (Safetica) and CVE-2025-7771 (ThrottleStop). Analysis of BYOVD (Bring Your Own Vulnerable Driver) TTPs for Ring 0 process termination and physical memory R/W…

  • enessakircolak/CVE-2025-7771 ★ 22 · Aug 10, 2026

    ThrottleStop.sys Arbitrary Physical Memory R/W

  • wqsv/ThrottleStopPoC ★ 19 · Aug 31, 2025

    CVE-2025-7771: Arbitrary physical memory and I/O port read/write via ThrottleStop driver

  • D4rkks/CVE-2025-7771-Vulnerability-Exploration ★ 15 · Apr 17, 2026

    Escalating privilege in the system from unsigned driver using throttlestop vulnerability

  • AmrHuss/throttlestop-exploit-rw ★ 15 · Nov 13, 2025

    Arbitrary physical memory read/write exploitation using ThrottleStop.sys (CVE-2025-7771) with superfetch address translation - Windows kernel security research

  • xM0kht4r/CVE-2025-7771 ★ 11 · Jan 13, 2026

    A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as well as virtual-to-physical address translation using…

  • Gabriel-Lacorte/CVE-2025-7771 ★ 11 · Oct 3, 2025

    Arbitrary Function Call Exploit using the ThrottleStop driver

  • Demoo1337/ThrottleStop ★ 11 · Sep 7, 2025

    CVE-2025-7771 ThrottleStop.sys privilege escalation exploit - unrestricted IOCTL access to physical memory via MmMapIoSpace

  • v31l0x1/ThrottleStopPPL ★ 6 · Dec 31, 2025

    Poc for CVE-2025-7771 to modify PPL Protection

  • datcathuh/CiGaslight ★ 2 · Oct 21, 2026

    PoC for CVE-2025-7771: abuses ThrottleStop.sys for arbitrary physical r/w, turns DSE off, then spoofs the integrity query so it still reports as enabled.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References