CVE-2025-64673: 
vulnerability analysis and mitigation

CVE-2025-64673 is an improper access control vulnerability in the Windows Storvsp.sys (Storage Virtualization Service Provider) driver that allows a locally authenticated attacker with low privileges to elevate their privileges on affected systems. It was disclosed and patched on December 9, 2025, as part of Microsoft's December 2025 Patch Tuesday security update. Affected products include Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2), Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2 Edition, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the Storvsp.sys kernel driver, which provides storage virtualization services in Windows environments. Due to insufficient access control enforcement within this driver, a low-privileged local user can interact with the driver in a way that results in privilege escalation to a higher-privileged context. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has local access (Microsoft MSRC). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an attacker to escalate from a low-privileged local account to high-privilege access, resulting in high confidentiality, integrity, and availability impact on the affected system. This could enable complete system compromise, installation of malware or rootkits, unauthorized access to sensitive data, modification of critical system configurations, and bypassing of existing security controls. In virtualized or multi-tenant server environments where Storvsp.sys is particularly relevant, exploitation could have broader implications for hosted workloads (Microsoft MSRC).

Microsoft released patches for CVE-2025-64673 on December 9, 2025, as part of the December 2025 Patch Tuesday update. Organizations should apply the relevant cumulative updates to bring affected systems to the following minimum versions or later:

• Windows Server 2025: 10.0.26100.7392
• Windows Server 2022: 10.0.20348.4467
• Windows Server 2022 23H2: 10.0.25398.2025
• Windows Server 2019: 10.0.17763.8146
• Windows 11 24H2 / 25H2: 10.0.26100.7392
• Windows 11 23H2: 10.0.22631.6345
• Windows 10 22H2: 10.0.19045.6691
• Windows 10 21H2: 10.0.19044.6691
• Windows 10 1809: 10.0.17763.8146

As a defense-in-depth measure, organizations should enforce least-privilege principles, restrict local user access on sensitive systems, and deploy endpoint detection and response (EDR) solutions to monitor for suspicious privilege escalation activity (Microsoft MSRC).

CVE-2025-64673 was covered as part of broader December 2025 Patch Tuesday roundups by several security outlets. BleepingComputer noted the patch release among 57 fixes that month, including 3 zero-days (BleepingComputer). The Zero Day Initiative published a December 2025 security update review covering the patch cycle (ZDI Blog). Sophos also covered the December Patch Tuesday in their security blog (Sophos News). No specific researcher commentary or significant social media discussion focused exclusively on this CVE was identified.