What is the CVSS score of CVE-2026-29923?

CVE-2026-29923 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of N A are affected by CVE-2026-29923?

PowerStrip driver versions through 3.90.736 contain a privilege escalation vulnerability that allows authenticated local users to gain SYSTEM-level access by exploiting kernel memory mapping via…

Is there a public PoC exploit available for CVE-2026-29923?

Yes, a public proof-of-concept exploit is available for CVE-2026-29923. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-29923?

Within 24 hours: Inventory all systems running PowerStrip driver and document current versions in use; disable or restrict PowerStrip if not operationally critical. Within 7 days: Contact PowerStrip vendor for patch availability and timeline; implement application whitelisting or driver code signing policies to restrict unauthorized driver execution. Within 30 days: Evaluate alternative solutions or complete driver updates as patches become available; deploy endpoint detection and response (EDR) monitoring for suspicious IOCTL requests and privilege escalation attempts targeting pstrip64.sys.

N A CVE-2026-29923

EUVD-2026-21014 HIGH

Improper Privilege Management (CWE-269)

2026-04-09 mitre

GHSA-g859-2xvj-jr82

Privilege Escalation N A

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:25 vuln.today

CVSS changed

Apr 14, 2026 - 17:22 NVD

7.8 (HIGH)

EUVD ID Assigned

Apr 09, 2026 - 19:45 euvd

EUVD-2026-21014

CVE Published

Apr 09, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL request enabling unprivileged users to map arbitrary physical memory into their address space and modify critical kernel structures.

AnalysisAI

PowerStrip driver (pstrip64.sys) through version 3.90.736 enables authenticated local users to escalate privileges to SYSTEM by sending malicious IOCTL requests that map arbitrary physical memory into user-mode address space, allowing modification of kernel structures. EPSS score of 0.02% (5th percentile) indicates low automated exploitation likelihood, though publicly available exploit code exists (PacketStorm Security reference), making this a realistic threat in environments where PowerStrip is deployed and local access is possible. No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.

Technical ContextAI

PowerStrip is a legacy display utility from EnTech Taiwan that includes a kernel-mode driver (pstrip64.sys) for low-level hardware interaction. The vulnerability stems from CWE-269 (Improper Privilege Management), where the driver exposes IOCTL handlers that fail to validate caller privileges or sanitize inputs controlling memory mapping operations. Windows IOCTL (Input/Output Control) interfaces allow user-mode applications to send commands to kernel drivers. When improperly secured, attackers can craft IOCTL requests to invoke privileged operations like mapping physical memory-bypassing CPU memory protection and enabling direct manipulation of kernel data structures such as process tokens, access control lists, or driver dispatch tables. This pattern is common in aging hardware utility drivers that predate modern Windows security models like HVCI and driver isolation.

RemediationAI

No vendor-released patch exists or will be developed, as PowerStrip is discontinued and unmaintained since approximately 2009-2010. Primary remediation is complete removal of PowerStrip software from all systems, including uninstalling the application via Control Panel and verifying deletion of pstrip64.sys from the Windows drivers directory (typically C:\Windows\System32\drivers). Organizations requiring legacy display management should migrate to actively supported alternatives such as manufacturer-provided GPU utilities (NVIDIA Control Panel, AMD Radeon Software) or modern open-source tools. For air-gapped/isolated systems where removal is operationally complex, implement compensating controls: enforce least-privilege user accounts (no local admin rights), enable Windows Defender Application Control or AppLocker to block unauthorized driver loading, and deploy endpoint detection and response (EDR) tools with behavioral monitoring for IOCTL-based kernel exploitation attempts. Regularly audit installed drivers using Microsoft Vulnerable Driver Blocklist and apply latest Windows security updates to harden kernel attack surface.