Description

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T10:16:40.457Z",
  "pubdate": "2026-08-27T10:16:40.457Z",
  "executiveSummary": "The WibuKey2_64.sys kernel driver for WibuKey on 64-bit Windows contains an untrusted pointer dereference vulnerability.\nThis vulnerability is classified as a write-what-where primitive, which enables a local attacker to achieve arbitrary kernel-mode code execution.\nThe flaw affects WibuKey for Windows versions prior to 6.71.\nSuccessful exploitation allows a local, unprivileged attacker to escalate their privileges to NT AUTHORITY\\SYSTEM, granting full control over the compromised host.\nThe risk implication is critical, as it bypasses standard Windows access controls via kernel-level exploitation.\nThis vulnerability is localized to the kernel driver, requiring the attacker to have initial local access to the system to interact with the driver interface.",
  "technicalDetails": "The vulnerability resides within the WibuKey2_64.sys kernel-mode driver, specifically stemming from improper validation of user-supplied pointers during I/O Request Packet (IRP) handling.\nThe root cause is an untrusted pointer dereference, where the driver fails to sufficiently sanitize or validate memory addresses provided by user-mode applications before performing write operations.\nThis deficiency creates a write-what-where primitive, allowing an attacker to overwrite arbitrary kernel memory locations with attacker-controlled data.\nTo exploit this, an attacker typically targets sensitive kernel structures, such as the HalDispatchTable, or modifies objects in the kernel's object manager to hijack the execution flow.\nThe attack flow begins with the attacker opening a handle to the vulnerable WibuKey device object, typically accessed via an IOCTL interface. By sending a specially crafted buffer containing an arbitrary memory address (the 'where') and the desired malicious data (the 'what'), the attacker triggers the flawed code path in the driver.\nBecause the driver performs this operation at the kernel level (Ring 0), the resulting write operation is not bound by user-mode memory protections or sandboxing.\nOnce the write-what-where primitive is established, the attacker can overwrite function pointers or security tokens associated with their own process, effectively escalating their current thread's privileges to SYSTEM.\nThe exploitation process typically concludes with the execution of arbitrary code in the context of the kernel, allowing for the deployment of persistent rootkits, disabling of security software, or the spawning of an administrator shell.\nThe vulnerability is limited to local exploitation; the attacker must have the ability to execute code on the target machine and communicate with the WibuKey driver device interface.\nThe scope of impact is total system compromise, given that the attacker gains administrative control from a lower privilege level, thereby subverting all OS-enforced security boundaries."
}