EUVD-2026-66984
GHSA-gqq4-6ppr-52p5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local low-privileged user reaches kernel driver via IOCTL; S:C reflects ring-0 boundary crossing granting full OS control.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
AnalysisAI
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged (non-administrator) interactive or remote-desktop session on a 64-bit Windows system with WibuKey software installed and the WibuKey2_64.sys driver loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects the exploitation profile: local unprivileged access is sufficient, exploitation complexity is low, no user interaction is required, and the scope change (S:C) captures the kernel boundary crossing from user-mode to SYSTEM. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a standard Windows user account on a 64-bit workstation where WibuKey is installed sends a crafted DeviceIoControl request to WibuKey2_64.sys containing a malicious pointer value. The driver dereferences this pointer in ring-0 without validation, giving the attacker a write-what-where primitive in kernel memory; the attacker then overwrites a security token or DACL structure to elevate their process to NT AUTHORITY\SYSTEM, then spawns an elevated command shell. … |
| Remediation | The primary fix is to upgrade WibuKey to version 6.71 or later, as confirmed by the WIBU-SYSTEMS AG advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100031.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running WibuKey, identify installed versions, and prioritize assessment of production environments and systems running business-critical protected applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wibukey versions up to 6.51 contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged a
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. Rated high severity (
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds che
Same weakness CWE-123 – Write-what-where Condition
View allShare
External POC / Exploit Code
Leaving vuln.today