CVE-2025-49730

HIGH

Windows 10/11, Server 2008 - Privilege Escalation via QoS Scheduler TOCTOU

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-49730. PoCs published by nu11secur1ty.

AI-analyzed exploit summary This PowerShell script checks for the presence of the vulnerable `storqosflt.sys` driver and verifies its version, digital signature, and integrity to determine if a system is affected by CVE-2025-49730. It does not exploit the vulnerability but provides detection capabilities.

Description

Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.

Exploits (1)

exploitdb SCANNER

by nu11secur1ty · textlocalwindows

https://www.exploit-db.com/exploits/52399

View Code ZIP pw:eip

This PowerShell script checks for the presence of the vulnerable `storqosflt.sys` driver and verifies its version, digital signature, and integrity to determine if a system is affected by CVE-2025-49730. It does not exploit the vulnerability but provides detection capabilities.

Classification

Scanner 95%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Microsoft Windows Storage QoS Filter Driver (storqosflt.sys)

Auth required

Prerequisites: Administrator privileges · PowerShell execution policy allowing script execution

MITRE ATT&CK

T1082 - System Information Discovery T1007 - System Service Discovery

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory patch

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49730

Scores

CVSS v3 7.8

EPSS 0.0351

EPSS Percentile 87.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-367 CWE-122

Status published

Products (17)

microsoft/windows_10_1507 < 10.0.10240.21073 (2 CPE variants)

microsoft/windows_10_1607 < 10.0.14393.8246 (2 CPE variants)

microsoft/windows_10_1809 < 10.0.17763.7558 (2 CPE variants)

microsoft/windows_10_21h2 < 10.0.19044.6093

microsoft/windows_10_22h2 < 10.0.19045.6093

microsoft/windows_11_22h2 < 10.0.22621.5624

microsoft/windows_11_23h2 < 10.0.22631.5624

microsoft/windows_11_24h2 < 10.0.26100.4652

microsoft/windows_server_2008 (2 CPE variants)

microsoft/windows_server_2008 r2 sp1

... and 7 more

Published Jul 08, 2025

Tracked Since Feb 18, 2026