CVE-2025-12052CWE-787

egwindrv.sys is potentially vulnerable to a buffer overflow.

High · published January 14, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

⚡ An untrusted application can exploit a registry reading flaw, turning your system into a playground for buffer overflow attacks! 🔥 Think of this like a diner where any customer can sneak into the kitchen and mess with the ingredients without anyone checking the order — it can lead to a recipe for disaster! An attacker could potentially cause a buffer overflow, leading to unauthorized access or system crashes. This is no small hiccup; it could compromise system integrity and open the door to further malicious activities.

Put simply

Think of this like a diner where any customer can sneak into the kitchen and mess with the ingredients without anyone checking the order — it can lead to a recipe for disaster! The vulnerability arises from the RTL_QUERY_REGISTRY_DIRECT flag being used in the tool packages, allowing an untrusted user-mode application to exploit the reading of a registry value and trigger a buffer overflow. This flaw allows for unexpected behavior and potential control over the system.

What to do

An attacker could potentially cause a buffer overflow, leading to unauthorized access or system crashes. This is no small hiccup; it could compromise system integrity and open the door to further malicious activities. To mitigate this risk, ensure that all applications handling registry queries are properly validated and sanitized. Patch your systems to the latest version as soon as a fix is available, and consider implementing strict user-mode application permissions. 🛡️ You've got this! Stay vigilant, follow the steps, and you'll keep your system safe! 💪✨

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-01-14T01:23Z
EPSS history
Timeline
  • 14 JAN 01:23Z
    egwindrv.sys is potentially vulnerable to a buffer overflow.
    cvelistv5