CVE-2025-61155

MEDIUM EXPLOITED RANSOMWARE

GameDriverX64.sys <7.23.4.7 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-61155 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns. EIP tracks 3 public exploits from researchers including pollotherunner, sf0rzin, sys0xFF.

AI-analyzed exploit summary This PoC demonstrates arbitrary process termination via a vulnerable IOCTL handler in the GameDriverX64.sys anti-cheat driver. It communicates with the driver to terminate a specified process (e.g., notepad.exe) by sending a crafted IOCTL request.

Description

The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers. A user-mode process can open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context without proper authentication or access validation, allowing the attacker to terminate arbitrary processes, including critical system and security services, without requiring administrative privileges.

Exploits (3)

nomisec WORKING POC 22 stars
by pollotherunner · poc
https://github.com/pollotherunner/CVE-2025-61155

This PoC demonstrates arbitrary process termination via a vulnerable IOCTL handler in the GameDriverX64.sys anti-cheat driver. It communicates with the driver to terminate a specified process (e.g., notepad.exe) by sending a crafted IOCTL request.

Classification
Working Poc 95%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: GameDriverX64.sys (anti-cheat driver)
No auth needed
Prerequisites: Local access to the system · Presence of the vulnerable GameDriverX64.sys driver · Target process running
MITRE ATT&CK
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by sf0rzin · poc
https://github.com/sf0rzin/CVE-2025-61155

This repository provides a functional PoC for CVE-2025-61155, a kernel-driver vulnerability in GameDriverX64.sys (Hotta Studio/PwrdDriver) that allows arbitrary process termination via a crafted IOCTL (0x222040) with a magic value (0xFA123456). The PoC demonstrates the exploit by terminating a target process (e.g., notepad.exe) after loading specific DLLs as part of the driver's verification process.

Classification
Working Poc 98%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: GameDriverX64.sys (Hotta Studio/PwrdDriver anti-cheat driver)
Auth required
Prerequisites: Driver must be loaded (e.g., via BYOVD or legitimate installation) · Attacker must have user-mode privileges to interact with the driver · Target process must be running
mistral-large-3 · analyzed Jul 15, 2026 Full analysis →
github WORKING POC
by sys0xFF · yaralocal
https://github.com/sys0xFF/CVE-2025-61155

This repository contains a functional proof-of-concept exploit for CVE-2025-61155, a kernel-driver vulnerability in GameDriverX64.sys that allows arbitrary process termination via an IOCTL. The PoC demonstrates the exploit chain by targeting a harmless process (notepad.exe) and includes detailed technical analysis, detection content, and mitigation guidance.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Moderate
Reliability
Reliable
Target: GameDriverX64.sys (Hotta Studio / PwrdDriver) anti-cheat driver
No auth needed
Prerequisites: Vulnerable driver loaded on the system · Local access to the system
mistral-large-3 · analyzed Jun 25, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 5.5
EPSS 0.0027
EPSS Percentile 19.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2026-01-29
Ransomware Use Confirmed
CWE
CWE-400
Status published
Published Oct 28, 2025
Tracked Since Feb 18, 2026