CVE-2025-51060 Details
Description
An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSR_LSTAR and hook KiSystemCall64. Afterward, using Return-Oriented Programming (ROP), the attacker can manipulate the stack with pre-prepared gadgets, disable the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been confirmed whether this works on 32-bit Windows, but it functions on 64-bit Windows if the core isolation feature is either absent or disabled.
A vulnerability allowing kernel-mode arbitrary code execution has been identified in the CPUID CPU-Z driver version 1.0.5.4. This issue arises from unvalidated parameters in the DeviceIoControl function, specifically with the IOControlCodes 0x9C402440 and 0x9C402444. Exploitation of this vulnerability involves manipulating the MSR_LSTAR model-specific register to hook into the KiSystemCall64 function, followed by a Return-Oriented Programming (ROP) attack that disables the Supervisor Mode Access Prevention (SMAP) feature and executes a user-mode syscall handler within the kernel context. While this vulnerability has not been confirmed on 32-bit Windows, it is functional on 64-bit Windows systems where core isolation is either disabled or not present.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZiaLib/Zmsr | [email protected] | Exploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| cpuid cpuz.sys | 1.0.5.4 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Oct 9, 2025 | Initial Analysis | [email protected] |
| Aug 5, 2025 | CVE Modified | CISA-ADP |
| Aug 5, 2025 | New CVE Received | [email protected] |