CVE-2025-64673CWE-284

Windows Storage VSP Driver Elevation of Privilege Vulnerability

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can elevate their privileges with a clever trick involving the Storvsp.sys Driver. It’s like getting VIP access to a party without an invite! 🎉 Think of this vulnerability as a guest who sneaks behind the bouncer at an exclusive event just by exploiting a gap in the guest list verification. When the security checks are weak, anyone could stroll in and gain access to areas they shouldn’t be in, like backstage! This flaw allows an attacker with limited access to escalate their privileges, potentially leading to unauthorized actions on the system. Imagine them gaining control over sensitive data, making system changes, or even wreaking havoc like a party crasher controlling the sound system! This could have serious repercussions, making it critical to address.

Put simply

Think of this vulnerability as a guest who sneaks behind the bouncer at an exclusive event just by exploiting a gap in the guest list verification. When the security checks are weak, anyone could stroll in and gain access to areas they shouldn’t be in, like backstage! The improper access control in the Storvsp.sys Driver enables an authenticated attacker to gain elevated privileges on the system. This vulnerability stems from inadequate checks that should prevent unauthorized elevation of access rights.

What to do

This flaw allows an attacker with limited access to escalate their privileges, potentially leading to unauthorized actions on the system. Imagine them gaining control over sensitive data, making system changes, or even wreaking havoc like a party crasher controlling the sound system! This could have serious repercussions, making it critical to address. To mitigate this risk, update the driver to the latest version immediately. Review access control policies to ensure they are stringent and conduct regular audits to detect any suspicious activities. Don't wait—security is a priority! You can tackle this! Follow the action steps and you’ll be one step closer to locking down your system. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00366 · 29.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-09T17:55Z
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Storage VSP Driver Elevation of Privilege Vulnerability
    cvelistv5