CVE-2025-64673
📋 TL;DR
CVE-2025-64673 is a local privilege escalation vulnerability in the Storvsp.sys driver that allows authenticated attackers to gain SYSTEM-level privileges. This affects Windows systems where an attacker already has some level of access. The vulnerability stems from improper access control mechanisms in the driver.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 25h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An attacker with initial access could gain full SYSTEM privileges, potentially compromising the entire system, installing persistent malware, accessing sensitive data, and moving laterally across the network.
Likely Case
Malicious insiders or attackers who have gained initial foothold through phishing or other means could elevate their privileges to bypass security controls and maintain persistence.
If Mitigated
With proper privilege separation, least privilege principles, and endpoint protection, the impact is limited to the compromised user account without system-wide compromise.
🎯 Exploit Status
Requires local authenticated access. Exploitation likely involves calling vulnerable driver functions with crafted parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Will be specified in Microsoft's monthly security update (Patch Tuesday)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64673
Restart Required: Yes
Instructions:
1. Check for Windows Updates
2. Install the latest security updates from Microsoft
3. Restart the system when prompted
4. Verify the update was applied successfully
🔧 Temporary Workarounds
Restrict driver loading
windowsConfigure Windows to only load signed drivers to prevent loading of malicious drivers that might exploit this vulnerability
bcdedit /set nointegritychecks off
bcdedit /set testsigning off
Apply least privilege
allEnsure users operate with minimal necessary privileges to limit impact if compromised
🧯 If You Can't Patch
- Implement strict access controls and monitor for suspicious privilege escalation attempts
- Use application control solutions to prevent execution of unauthorized binaries and scripts
🔍 How to Verify
Check if Vulnerable:
Check the version of storvsp.sys in System32\drivers and compare with patched versions from Microsoft advisoryCheck Version:
powershell Get-Item C:\Windows\System32\drivers\storvsp.sys | Select-Object VersionInfoVerify Fix Applied:
Verify Windows Update history shows the relevant security update installed and check driver version matches patched version📡 Detection & Monitoring
Log Indicators:
- Event ID 4697: Service installation
- Suspicious driver loading events
- Privilege escalation attempts in security logs
Network Indicators:
- Unusual outbound connections following local privilege escalation
SIEM Query:
EventID=4697 OR (EventID=4688 AND NewProcessName LIKE '%storvsp%')