Security readout for executives and security teams
Plain-English summary
CVE-2025-67246 is a local data exposure flaw in the Ludashi driver before version 5.1025. A normal user on an affected machine may read sensitive physical memory. This is not a remote attack, but it can help an attacker defeat kernel protections and move toward local privilege escalation.
Executive priority
Treat as high priority where Ludashi is present, especially on shared or administrator-used endpoints. It is local-only, so urgency depends on endpoint exposure and attacker foothold risk. Patch or remove quickly after confirming affected driver versions.
Technical view
The driver exposes a user-accessible device interface and lacks access control in an IOCTL handler. It maps attacker-controlled physical addresses with MmMapIoSpace and copies memory back to user mode without validating caller privilege or target range. Reported impacts include kernel data disclosure, pointer leaks, token exposure, KASLR bypass, and possible local privilege escalation.
Likely exposure
Exposure is likely limited to Windows systems with the Ludashi driver installed at versions before 5.1025. The CVE metadata does not provide CPEs or a complete affected product inventory, so organizations should validate by local software and driver inventory rather than product-name matching alone.
Exploitation context
The vulnerability requires local access with low privileges and no user interaction. The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The main risk is post-compromise escalation support: memory disclosure can weaken kernel defenses and expose sensitive kernel information.
Researcher notes
CWE mappings are CWE-269 and CWE-732. CVSS is 7.3, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. Public details are sufficient to understand the flawed access-control model, but the bundle lacks complete vendor product metadata, CPEs, and official remediation notes beyond the pre-5.1025 version boundary.
Mitigation direction
- Identify systems with the Ludashi driver installed.
- Check the installed driver version against 5.1025.
- Update to version 5.1025 or later if vendor guidance confirms availability.
- Remove the driver where it is not required.
- Restrict software deployment of vulnerable Ludashi driver versions.
- Monitor vendor and CVE sources for updated remediation guidance.
Validation and detection
- Inventory endpoints for Ludashi driver presence and version.
- Confirm whether normal users can access the driver device interface.
- Review EDR telemetry for suspicious local driver access patterns.
- Prioritize validation on shared, kiosk, developer, and high-privilege admin workstations.
- Document systems where remediation is unavailable or vendor guidance is unclear.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-732: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-67246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N24.7CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/CDipper/CVE-PublicationCVE reference, mitre
- https://github.com/CDipper/CVE-2025-67246CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.