WibuKey CVE-2026-81581

Exploitation requires a local Windows user-level account (low privilege - standard domain or local user) on a machine where WibuKey version 6.70 or earlier is installed and the WibuKey64.sys driver is loaded and running. The attacker must be able to open a file handle to the driver device and submit IOCTL requests - a capability typically available to all local users without administrator rights, which is what drives the PR:L and AV:L CVSS metrics. No special WibuKey configuration, no active dongle connection, and no user interaction from another account are required. Exploitation is bounded by three concrete limiting factors: (1) the attacker must have an interactive or network logon session on the target host - pure remote unauthenticated attack is not possible; (2) WibuKey software must be installed and its driver loaded, meaning hosts without the product are entirely unaffected; (3) only Windows is affected - the 64-bit driver is Windows-specific.

The vendor-reported CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-calibrated for this vulnerability class. The low attack complexity and low privileges required mean that any standard domain or local user account on an affected system is sufficient to trigger exploitation - no administrator access, no special configuration, and no user interaction are needed. The Scope:Changed metric is the key risk amplifier: the attacker's low-privilege process context crosses into SYSTEM-privileged kernel space through the driver, yielding C:H/I:H/A:H impact across the entire operating system. The description hedges between DoS and full RCE/PE, which is common for kernel memory corruption bugs before PoC development; historical precedent for this class (CWE-119 in Windows kernel drivers) shows reliable privilege escalation is typically achievable with research effort. No EPSS score or KEV listing was provided, meaning exploitation probability from external data cannot be quantified and no confirmed in-the-wild exploitation is known. The local attack vector (AV:L) prevents direct remote exploitation, meaningfully limiting opportunistic attack surface compared to a network-vector flaw - but this is a textbook local privilege escalation step in a post-compromise chain or insider threat scenario.

A local attacker holding a standard Windows user account on a system with WibuKey ≤6.70 installed opens a handle to WibuKey64.sys and issues crafted IOCTL requests containing pointer values that fall outside the driver's valid memory scope. The driver dereferences these out-of-bounds pointers without validation in SYSTEM-privileged kernel context, corrupting kernel memory; with sufficient effort this can be converted from a reliable BSOD (DoS) into a controlled write primitive that overwrites a kernel function pointer or security token, granting the attacker SYSTEM-level process privileges. No public proof-of-concept has been identified at time of analysis, but the attack complexity is rated Low.