Executive brief
A vulnerability exists in a driver component of the CPU-Z utility, which is commonly used to monitor system hardware information. An attacker can exploit this flaw to gain unauthorized control over the computer's core operating system (the kernel). This could allow them to bypass security protections, monitor user activity, or take full control of the affected Windows machine, provided certain advanced security features like Core Isolation are disabled.
Technical details
A vulnerability in CPUID's cpuz.sys driver (version 1.0.5.4) stems from improper validation of IOCTL codes 0x9C402440 and 0x9C402444. These codes allow an attacker to perform RDMSR (Read Model Specific Register) and WRMSR (Write Model Specific Register) operations. By modifying the MSR_LSTAR register, an attacker can hook the KiSystemCall64 routine. Using Return-Oriented Programming (ROP) gadgets, the attacker can then disable Supervisor Mode Access Prevention (SMAP) in the CR4 register and execute a user-mode syscall handler within the kernel context. This exploit is confirmed to work on 64-bit Windows systems where Core Isolation (VBS/HVCI) is disabled or unavailable.
Affected products
- CPUID cpuz.sys 1.0.5.4
Timeline
- 2025-08-05: disclosed
- 2025-08-05: advisory