CVE-2025-65264 Information disclosure in n/a

Medium 5.5 Published 27 Jan 2026 Updated 27 Jan 2026

An attacker can access sensitive information by sending crafted requests to the CPU-Z kernel driver due to missing input validation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-65264?

CVE-2025-65264 is a medium-severity vulnerability in n/a, published on 27 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request.

Weakness: CWE-20

Which versions are affected by CVE-2025-65264?

It affects 1 product.

Products include Cpuid Cpu-Z.

How do I fix CVE-2025-65264?

No fix has been published for CVE-2025-65264 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-65264 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65264 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-5xj3-mjvp-h43q.