HighPublic exploit

Arbitrary kernel memory write in CPUID CPU-Z driver

IdentifiersCVE-2017-15303CWE-123

CVE-2017-15303 affects CPUID CPU-Z before version 1.43. The issue is in the CPU-Z kernel-mode driver (for example, cpuz141_x64.sys in version 1.41), which exposes an IOCTL interface that can be reached locally while CPU-Z is running. A local program can issue ioctl 0x9C402430 to the driver and trigger an arbitrary memory write condition in kernel context. Because the vulnerable functionality is reachable from user mode through the driver, an unprivileged local process can corrupt or modify privileged kernel memory. The provided context further indicates this flaw has been used to read and write physical memory and read CPU control registers, enabling post-exploitation abuse such as disabling Windows Driver Signature Enforcement (DSE) and loading unsigned kernel drivers.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results directly in local elevation of privileges to kernel/SYSTEM level. Because the primitive is an arbitrary kernel memory write, an attacker can modify security-critical kernel state, bypass Windows protections, and execute privileged actions. The supplied context specifically notes use of this vulnerability to disable Windows Driver Signature Enforcement, allowing unsigned or malicious drivers to be loaded, which in turn enables stealthy persistence, rootkit deployment, and broader defense evasion.

Mitigation

If you can’t patch tonight, do this now.

Prevent exploitation by ensuring CPU-Z is not running on systems where untrusted local code may execute, since the vulnerable IOCTL is reachable while the driver is active. Restrict local code execution, application installation, and administrative access to reduce opportunities for abuse. Use Microsoft vulnerable driver block rules / WDAC or equivalent controls to prevent known-bad kernel drivers from loading. Monitor for suspicious access to the CPU-Z driver device and for attempts to disable DSE or load unsigned drivers.

Remediation

Patch, then assume compromise.

Upgrade CPUID CPU-Z to version 1.43 or later so the vulnerable driver is no longer exposed. Remove or replace vulnerable CPU-Z driver files such as cpuz141_x64.sys from affected systems. If the software is not required, uninstall CPU-Z entirely and ensure the driver service is removed. In environments concerned with BYOVD abuse, block loading of known-vulnerable drivers and maintain current Windows driver blocklists.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

StrykerMaturityPoCVerified exploit

This repository contains the full source code for Stryker, a multi-purpose proof-of-concept tool that exploits CVE-2017-15303 (a vulnerability in the CPU-Z 1.41 driver) to perform advanced kernel-level operations on x64 Windows systems. The main capabilities are: - Disabling/enabling Driver Signature Enforcement (DSE), allowing unsigned drivers to be loaded. - Hijacking protected processes by modifying their kernel objects (EPROCESS), effectively bypassing process protection mechanisms. - Loading arbitrary unsigned drivers into kernel mode by injecting shellcode into a signed driver (procexp152.sys) and triggering execution via crafted IRPs. The repository is structured into several Visual Studio projects: - `src/Maya/` contains the main Stryker tool, including all core logic for exploitation, driver mapping, process manipulation, and memory access routines. - `src/DummyDrv/` and `src/DummyDrv2/` provide example kernel drivers for testing driver loading and device communication. - The code is written in C and is intended for advanced users with knowledge of Windows kernel internals. The exploit is operational and provides real kernel-level payloads, but requires specific drivers (cpuz141.sys and procexp152.sys) to be present. It is not weaponized in the sense of being part of a larger exploitation framework, but it is a fully functional local privilege escalation and kernel code execution tool for vulnerable Windows systems.

hfiref0xDisclosed Feb 22, 2018ccpplocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

CpuidCpu-Zapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

trend micro researchNews

Apr 9, 2021

Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware

A vulnerability in CPU-Z that allows read/write access to physical memory and CPU control registers, used here to disable Windows Driver Signature Enforcement and load an unsigned rootkit driver.

mitre attackNews

Jan 24, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows Driver Signature Enforcement (DSE) bypass vulnerability used by Pandora to load a driver.

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows Driver Signature Enforcement bypass vulnerability used to load a driver (Pandora).

mitre attackNews

Mar 18, 2026

Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®

Windows Driver Signature Enforcement (DSE) bypass vulnerability used by Pandora to load a driver.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence1

Every observed campaign linking this CVE to a named adversary.

Associated malware3

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity