# CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

- Page: https://www.vulneraibility.com/cve/CVE-2025-7771
- CVSS: not scored
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 6.78% (percentile 94.1)
- Public exploit code: 1 on Exploit-DB · 14 GitHub proofs of concept (first 2025-08-31)
- CISA SSVC: exploitation none, automatable no, technical impact partial (assessed 2025-08-06)
- Weakness: CWE-782
- Published: 2025-08-06

## Affected versions

- TechPowerUp ThrottleStop: affected 3.0.0.0 and possibly others

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md
- [other] https://www.techpowerup.com/download/techpowerup-throttlestop/
- [other] https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.