CVE-2025-67246 Information disclosure in n/a
Unprivileged users can read arbitrary physical memory via the Ludashi driver, enabling KASLR bypass and local privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-67246?
CVE-2025-67246 is a high-severity vulnerability in n/a, published on 15 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver exposes a device interface accessible to a normal user and handles attacker-controlled structures containing the lower 4GB of physical addresses. The handler maps arbitrary physical memory via MmMapIoSpace and copies data back to user mode without verifying the caller's privileges or the target address range. This allows unprivileged users to read arbitrary physical memory, potentially exposing kernel data structures, kernel pointers, security tokens, and other sensitive information. This vulnerability can be further exploited to bypass the Kernel Address Space Layout Rules (KASLR) and achieve local privilege escalation.
Which versions are affected by CVE-2025-67246?
It affects 1 product.
Products include Ludashi Ludashi Driver.
How do I fix CVE-2025-67246?
No fix has been published for CVE-2025-67246 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-67246 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67246 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-c23h-wjw2-xvwf.