Loading story…
Microsoft disclosed multiple Elevation of Privilege vulnerabilities in the Kernel Streaming Service Driver, identifying CVE-2024-38238, CVE-2024-38244, CVE-2024-38245, and CVE-2025-24066 in its Security Update Guide. The issues affect a low-level Windows driver component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited.
The advisories provide limited public technical detail, but the grouping of several CVEs against the same driver indicates repeated security weaknesses in the Windows Kernel Streaming attack surface. Organizations should prioritize Microsoft security updates covering these CVEs, review endpoint exposure across supported Windows assets, and monitor for signs of local privilege-escalation activity involving kernel-level components.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft added a Security Update Guide entry for CVE-2025-24066, another Kernel Streaming Service Driver elevation of privilege vulnerability. This marks a later, distinct disclosure and patch cycle affecting the same component family.
Microsoft published a Security Update Guide entry for CVE-2025-21375, identified as a Kernel Streaming WOW Thunk Service Driver elevation of privilege vulnerability. This represents a separate disclosure and patch event affecting the broader Kernel Streaming driver family.
Microsoft published Security Update Guide entries for CVE-2024-38238, CVE-2024-38244, and CVE-2024-38245, all described as Kernel Streaming Service Driver elevation of privilege vulnerabilities. The simultaneous publication indicates these flaws were disclosed and addressed as part of Microsoft's September 2024 security updates.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched two **Elevation of Privilege** vulnerabilities in the **Kernel Streaming Service Driver**, tracked as `CVE-2024-38242` and `CVE-2025-24067`, through its Security Update Guide. Both issues affect a core Windows driver component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited. The advisories indicate a recurring security weakness in the Kernel Streaming Service Driver across separate update cycles, underscoring the importance of applying Microsoft security updates promptly. Organizations running Windows systems should prioritize remediation for affected assets because privilege-escalation flaws in kernel-level components can be used to move from limited access to more powerful system control.
Jul 12, 2026
Microsoft disclosed and patched multiple **elevation of privilege** vulnerabilities in the **Kernel Streaming WOW Thunk Service Driver**, including `CVE-2025-24995` and `CVE-2025-49675`, through its Security Update Guide. Both issues affect a Windows kernel component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited. The advisories provide limited public technical detail, but the repeated identification of the same driver across separate CVEs indicates an ongoing security focus on the **Kernel Streaming WOW Thunk Service Driver** as a privileged attack surface in Windows. Organizations should prioritize applying the relevant Microsoft security updates and review affected Windows assets for exposure to local privilege escalation risk tied to this component.
Jul 12, 2026
Microsoft published security advisories for a series of **Windows elevation-of-privilege** vulnerabilities affecting the **Windows Kernel**, **File Explorer**, **Windows Management Service**, **Windows UI XAML Phone DatePickerFlyout**, **Windows Graphics Component**, **Windows Storage**, and the **DirectX Graphics Kernel**. The referenced flaws include `CVE-2026-26132`, `CVE-2025-62565`, `CVE-2025-54103`, `CVE-2025-54111`, `CVE-2025-55693`, `CVE-2024-38249`, `CVE-2025-62573`, `CVE-2024-38248`, and `CVE-2025-55678`. The disclosures indicate a broad patching effort spanning core operating system subsystems and user-facing Windows components, with repeated exposure in privileged areas such as the kernel and graphics stack. For defenders, the concentration of elevation-of-privilege issues across these components raises the risk that attackers could chain local access or code execution with privilege escalation to gain **SYSTEM-level** or otherwise expanded rights on affected Windows systems, making prompt validation and deployment of Microsoft updates a priority.
Jun 29, 2026