DriveLock
CVE-2025-67790
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged user session
-
ExploitSend crafted IOCTL with unterminated string
-
ImpactTrigger kernel buffer over-read / BSOD
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Null terminator handling
|
| Exploitation Conditions | Requires a local, interactive (unprivileged) user account on a Windows host running an affected DriveLock build (24.1 before 24.1.6, 24.2 before 24.2.7, or 25.1 before 25.1.5); the user must be able to open the DriveLock kernel driver and issue a device IOCTL carrying an unterminated string. Limiting factors: no remote or network path despite the NVD AV:N label, no authentication bypass (a valid local session is needed), impact is limited to an intermittent/'occasional' crash with no code execution or data disclosure, and only unpatched versions are affected. |
| Impact | The real-world risk is modest and lower than the 7.5/HIGH score suggests. The impact is confined to availability (C:N/I:N/A:H) - an occasional Blue Screen of Death, i.e. a transient local denial of service with no code execution, privilege gain, or data exposure. A significant signal conflict undermines the NVD CVSS vector: it asserts AV:N (network) and PR:N (unauthenticated), yet the description explicitly requires 'an unprivileged user' to send 'an IOCTL' to the DriveLock kernel driver - IOCTL device control is a local operation performed by a logged-on user, not a remote network action. This strongly implies the vector should be AV:L/PR:L, not AV:N/PR:N - verify with the vendor. No EPSS score was supplied (unknown exploitation probability), the CVE is not listed in CISA KEV, and no public exploit code was provided, so there is no public exploit identified at time of analysis. The word 'occasionally' further indicates the crash is non-deterministic, reducing reliability even for a local attacker. Net: a low-privilege local DoS in a niche endpoint-security product, patched by the vendor - a routine-priority patch item, not an emergency. |
| Exploit ScenarioDerived | A logged-on, unprivileged user on a Windows endpoint running an affected DriveLock version opens a handle to the DriveLock driver and issues a crafted IOCTL containing an unterminated string, triggering a buffer over-read in kernel space. The driver's improper null-termination handling leads to a kernel fault and an occasional Blue Screen of Death, disrupting that single machine. No public exploit code was provided, and the crash is intermittent rather than reliably reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) can intermittently crash the machine with a Blue Screen of Death by sending a device IOCTL containing an unterminated string to the DriveLock kernel driver, triggering a buffer over-read. The flaw is an improper null-termination (CWE-170) defect that is availability-only: there is no code execution, no privilege escalation, and no confirmed data disclosure, and it requires a valid local interactive session (no remote path), which is why the practical risk is lower than the 7.5 HIGH score implies. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all three affected branches.
RemediationAI
Vendor-released patch: upgrade to DriveLock 24.1.6, 24.2.7, or 25.1.5 (matching your installed branch) per the advisory at https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-005-BufferOverreadBSOD.htm, and reboot so the updated kernel driver is loaded. Because the trigger requires a local, unprivileged user to open the DriveLock device object and issue the malformed IOCTL, compensating controls are narrow: tighten the driver device object's ACL (SDDL) or otherwise restrict which non-administrative sessions can open a handle to the DriveLock driver, accepting the trade-off that overly restrictive permissions can break legitimate agent-to-driver communication and management-console operations; alternatively, prioritize patching hosts with shared or multi-user profiles where an unprivileged local user is most likely to attempt the IOCTL, since network-level filtering is irrelevant given there is no remote vector. Monitor Windows crash dumps/event logs for recurring BSODs on DriveLock-managed endpoints as a detection signal, and note that tightening driver access controls should be validated in a test ring before fleet-wide rollout.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2025-67790 is rooted in CWE-170 (Improper Null Termination). The DriveLock agent exposes a kernel-mode driver on Windows that processes IOCTL requests; when a caller passes a string buffer that is not null-terminated, the driver's parsing routine reads past the intended buffer boundary (the vendor advisory is titled 'BufferOverreadBSOD'), and on affected builds this over-read occasionally escalates into a fatal kernel fault and a Blue Screen of Death. CPE data identifies the impacted product line as cpe:2.3:a:drivelock:drivelock across three version branches, and the only reference is the vendor security bulletin for the 2025.1 release train. Note the vector disagreement between sources: NVD publishes CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), but the authoritative assessment for this analysis is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, reflecting that the IOCTL must be issued from a local Windows session holding a valid account rather than from the network, and that the crash is intermittent ('occasional' BSOD) rather than a reliable denial of service. The auto-generated 'Information Disclosure' tag on this record is not supported by the impact assessment, which scores confidentiality and integrity as None; treat availability as the only demonstrated impact.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
IOCTL delivery by a logged-on unprivileged user means AV:L and PR:L, not the NVD AV:N/PR:N; impact is availability-only (BSOD), so C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.
Executive ViewAI
Windows endpoints running DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) can be intermittently crashed to a blue screen by any unprivileged user who already has a local interactive session on the machine. The defect affects availability only - there is no code execution, privilege escalation, or confirmed data disclosure - so the exposure is operational disruption to encrypted endpoints and their data-loss-prevention coverage rather than a breach pathway. Leadership should care because repeated endpoint crashes degrade workforce productivity and can mask or interrupt the very controls protecting regulated data, even though no public exploit code or active exploitation has been identified at time of analysis.
Apply vendor patch (fixed builds 24.1.6, 24.2.7, and 25.1.5 for the 24.1, 24.2, and 25.1 branches respectively); where patching cannot be completed immediately, limit local interactive logon privileges on affected Windows hosts, monitor for repeated unexpected shutdowns on DriveLock-equipped endpoints, and ensure recovery procedures are in place.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 bef
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actor
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker in
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-admi
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) al
GitHub PoC
Exploit-DB