Loading story…
Microsoft disclosed and patched two Elevation of Privilege vulnerabilities in the Kernel Streaming Service Driver, tracked as CVE-2024-38242 and CVE-2025-24067, through its Security Update Guide. Both issues affect a core Windows driver component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited.
The advisories indicate a recurring security weakness in the Kernel Streaming Service Driver across separate update cycles, underscoring the importance of applying Microsoft security updates promptly. Organizations running Windows systems should prioritize remediation for affected assets because privilege-escalation flaws in kernel-level components can be used to move from limited access to more powerful system control.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2025-24067, another Kernel Streaming Service Driver Elevation of Privilege vulnerability, to its Security Update Guide. This marks public disclosure of the vulnerability through Microsoft's official advisory channel.
Microsoft added CVE-2024-38242, a Kernel Streaming Service Driver Elevation of Privilege vulnerability, to its Security Update Guide. This indicates public disclosure and availability of Microsoft's advisory information for the flaw.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **Elevation of Privilege** vulnerabilities in the **Kernel Streaming Service Driver**, identifying `CVE-2024-38238`, `CVE-2024-38244`, `CVE-2024-38245`, and `CVE-2025-24066` in its Security Update Guide. The issues affect a low-level Windows driver component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited. The advisories provide limited public technical detail, but the grouping of several CVEs against the same driver indicates repeated security weaknesses in the Windows Kernel Streaming attack surface. Organizations should prioritize Microsoft security updates covering these CVEs, review endpoint exposure across supported Windows assets, and monitor for signs of local privilege-escalation activity involving kernel-level components.
Jul 12, 2026
Microsoft disclosed and patched multiple **elevation of privilege** vulnerabilities in the **Kernel Streaming WOW Thunk Service Driver**, including `CVE-2025-24995` and `CVE-2025-49675`, through its Security Update Guide. Both issues affect a Windows kernel component and could allow an attacker to gain higher privileges on a targeted system if successfully exploited. The advisories provide limited public technical detail, but the repeated identification of the same driver across separate CVEs indicates an ongoing security focus on the **Kernel Streaming WOW Thunk Service Driver** as a privileged attack surface in Windows. Organizations should prioritize applying the relevant Microsoft security updates and review affected Windows assets for exposure to local privilege escalation risk tied to this component.
Jul 12, 2026
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting core operating system components, including **Windows Secure Kernel Mode**, the **Windows kernel**, and **NTFS**. The issues were tracked as `CVE-2024-43646`, `CVE-2025-21325`, `CVE-2025-49678`, and `CVE-2025-59207`, and were published through the Microsoft Security Response Center's Security Update Guide. The vulnerabilities span privileged parts of Windows that, if exploited, could allow an attacker to gain higher permissions on a compromised system. The affected areas include secure kernel functionality, general kernel operations, and the NTFS file system, underscoring continued risk from local privilege-escalation bugs in foundational Windows components and the importance of applying Microsoft security updates promptly.
Jul 12, 2026