Vulnerability in Techpowerup Throttlestop

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

Published · last modified .

EPSS exploit prediction

EPSS: 0.080 (94.6th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-7771: rose from 0.068 to 0.080.

EPSS over last 30 days · oldest: 0.068 · newest: 0.080 · change: +0.012

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-7771?
CVE-2025-7771 is a vulnerability in Techpowerup Throttlestop, classified under CWE-782. Published 2025-08-06.
Is CVE-2025-7771 known to be exploited?
19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.