Loading story…
Microsoft disclosed and patched multiple elevation of privilege vulnerabilities in the Kernel Streaming WOW Thunk Service Driver, including CVE-2025-24995 and CVE-2025-49675, through its Security Update Guide. Both issues affect a Windows kernel component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited.
The advisories provide limited public technical detail, but the repeated identification of the same driver across separate CVEs indicates an ongoing security focus on the Kernel Streaming WOW Thunk Service Driver as a privileged attack surface in Windows. Organizations should prioritize applying the relevant Microsoft security updates and review affected Windows assets for exposure to local privilege escalation risk tied to this component.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide entry for CVE-2025-49675, also affecting the Kernel Streaming WOW Thunk Service Driver as an elevation of privilege vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-24995, a Kernel Streaming WOW Thunk Service Driver elevation of privilege vulnerability.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched two **Elevation of Privilege** vulnerabilities in the **Kernel Streaming Service Driver**, tracked as `CVE-2024-38242` and `CVE-2025-24067`, through its Security Update Guide. Both issues affect a core Windows driver component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited. The advisories indicate a recurring security weakness in the Kernel Streaming Service Driver across separate update cycles, underscoring the importance of applying Microsoft security updates promptly. Organizations running Windows systems should prioritize remediation for affected assets because privilege-escalation flaws in kernel-level components can be used to move from limited access to more powerful system control.
Jul 12, 2026
Microsoft disclosed multiple **Elevation of Privilege** vulnerabilities in the **Kernel Streaming Service Driver**, identifying `CVE-2024-38238`, `CVE-2024-38244`, `CVE-2024-38245`, and `CVE-2025-24066` in its Security Update Guide. The issues affect a low-level Windows driver component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited. The advisories provide limited public technical detail, but the grouping of several CVEs against the same driver indicates repeated security weaknesses in the Windows Kernel Streaming attack surface. Organizations should prioritize Microsoft security updates covering these CVEs, review endpoint exposure across supported Windows assets, and monitor for signs of local privilege-escalation activity involving kernel-level components.
Jul 12, 2026
Microsoft disclosed and patched multiple Windows elevation-of-privilege vulnerabilities affecting core system components, including the **Windows Kernel** (`CVE-2023-36403`) and the **Windows Graphics Component** (`CVE-2023-38159`, `CVE-2023-24899`). The flaws could allow an attacker who already has access to a target system to gain higher privileges, increasing the risk of full system compromise and broader post-exploitation activity. The advisories show a recurring pattern of privilege-escalation risk in foundational Windows components that are widely present across enterprise environments. Organizations running affected Windows systems should prioritize applying Microsoft security updates for the listed CVEs and review endpoint detections for signs of local privilege-escalation attempts tied to kernel- or graphics-related processes.
Jul 12, 2026