Description

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T10:16:40.617Z",
  "pubdate": "2026-08-27T10:16:40.617Z",
  "executiveSummary": "The vulnerability identified in WibuKey64.sys, affecting WibuKey versions up to 6.70 for Windows, consists of improper validation of memory boundaries. This flaw allows an attacker to manipulate pointers to point outside the intended scope of the driver, resulting in unauthorized memory access. Because WibuKey64.sys operates with kernel-level (SYSTEM) privileges, the primary impact of this vulnerability is a Denial of Service (DoS) via system crash; however, the architectural nature of the flaw presents a significant risk for potential Remote Code Execution (RCE) and local Privilege Escalation. Exploitation requires an attacker to successfully interface with the vulnerable driver, posing a threat to the integrity and stability of the underlying Windows host environment.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient bounds check mechanism within the WibuKey64.sys driver. Specifically, the driver fails to adequately validate input parameters or pointer addresses provided to its internal functions before accessing memory. By supplying crafted values, an attacker can influence pointer arithmetic, effectively forcing the driver to read from or write to memory regions outside of its allocated buffer scope.\nThe exploitation flow typically begins with an attacker gaining local access to the target system. The attacker interacts with the WibuKey64.sys driver, likely through IOCTL (Input/Output Control) codes facilitated by the WibuKey API. By sending a malicious request containing manipulated pointers, the attacker triggers the driver to operate on an out-of-bounds memory address. Because the driver operates in kernel mode (Ring 0), the resulting memory corruption occurs within the context of the SYSTEM account.\nIf the out-of-bounds access results in an illegal memory reference, the kernel will trigger a bug check, resulting in an immediate system crash (Denial of Service). However, if the attacker can achieve controlled write primitives via this vulnerability, they may be able to overwrite critical kernel structures, such as function pointers, process tokens, or System Service Descriptor Table (SSDT) entries. By hijacking the execution flow, an attacker can escalate privileges from a low-privileged user account to SYSTEM or execute arbitrary code within the kernel space, effectively bypassing Windows security features like KASLR or SMEP if not properly mitigated.\nThe vulnerability is present in WibuKey64.sys versions up to 6.70. Since the driver is automatically loaded and executed with SYSTEM privileges upon initialization of WibuKey services, the attack surface is exposed to any process capable of communicating with the device object associated with the driver. There are no authentication requirements specified for the vulnerable IOCTL path, meaning any user on the system could theoretically trigger the vulnerability."
}