Two chained flaws in Windows storvsp.sys (CVE-2025-59517 + CVE-2025-64673) let a low-privileged user write arbitrary files to C:\Windows\System32 and escalate to NT AUTHORITY\SYSTEM. Patched December 2025; requires Virtual Machine Platform feature enabled. Key details: - CVE-2025-59517 is in VspVsmbFileCreate() inside storvsp.sys. Opening a vSMB path via CreateFileW() with FILE_READ_DATA only causes IoCreateFileEx() to use OBJ_KERNEL_HANDLE without OBJ_FORCE_ACCESS_CHECK, so NTFS ACL checks are bypassed entirely and the impersonation token is ignored. Result: a privileged share handle to any directory, including C:\Windows\System32, with HasWriteAccess left unset. - CVE-2025-64673 is in VspVsmbHandleSetInformationFileRequest(), triggered by IOCTL 0x240330. When HasWriteAccess is unset, impersonation is skipped and the InformationClass is silently swapped to FileRenameInformationBypassAccessCheck. A crafted VSTOR_VSMB_SET_INFORMATION_FILE_REQUEST buffer renames an attacker-controlled DLL into System32 as wuapi.dll, replacing the legitimate file. - Stage 3 invokes the IWaaSRemediation COM interface (CLSID 72566E27-1ABB-4EB3-B4F0-EB431CB1CB32) via LaunchDetectionOnly(), which loads wuapi.dll under a SYSTEM process. The payload DLL enables SeTcbPrivilege, calls SetTokenInformation to move from session 0 to the active console session, and spawns cmd.exe on the user's desktop as SYSTEM. #DFIR_Radar
Post summary
The post discloses two chained Windows storvsp.sys vulnerabilities, detailing bypass mechanisms and remediation, and notes a December 2025 patch with a Virtual Machine Platform requirement.