A heap-based buffer overflow in the virtio-win Viosock driver enables local privilege escalation on Windows guest systems, posing a significant risk to virtualized environments.

This vulnerability involves an integer overflow in the Viosock driver during the handling of IOCTL_SELECT requests. An authenticated low-privilege user can supply crafted input that bypasses size checks, resulting in a heap-based buffer overflow that facilitates arbitrary kernel memory corruption.

Successful exploitation of this vulnerability allows a local attacker to escalate privileges to the kernel level, effectively bypassing Windows security boundaries. This could lead to full system compromise, exfiltration of sensitive data residing in memory, or persistent denial of service. With a CVSS score of 7.8, the vulnerability represents a high risk for organizations relying on virtualized Windows infrastructure, as it provides a clear path for lateral movement or deeper system infiltration.

Immediate Action: Update the virtio-win driver suite to version mm320 or later to apply the necessary bounds checking fixes.

Proactive Monitoring: Monitor Windows Event Logs for suspicious kernel-mode crashes or unexpected driver behavior related to the Viosock component.

Compensating Controls: Restrict access to virtualized environments to prevent untrusted local users from interacting with the guest driver interfaces.

Public Exploit Available: No — exploit_available (false).

Given the potential for privilege escalation and kernel-level control, this vulnerability should be treated with high priority. Administrators must audit their virtualized assets to identify instances running vulnerable versions of the virtio-win drivers and ensure they are upgraded to mm320 immediately. Failure to patch may leave systems vulnerable to local attacks that could bypass standard administrative controls and compromise the integrity of the host-guest security model.