EUVD-2026-66985
GHSA-m4jv-48jv-489g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Low-privilege local access reaches SYSTEM-privileged kernel driver; scope changes to OS kernel justifying S:C with full C/I/A impact.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
AnalysisAI
WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local Windows user-level account (low privilege - standard domain or local user) on a machine where WibuKey version 6.70 or earlier is installed and the WibuKey64.sys driver is loaded and running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-reported CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-calibrated for this vulnerability class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker holding a standard Windows user account on a system with WibuKey ≤6.70 installed opens a handle to WibuKey64.sys and issues crafted IOCTL requests containing pointer values that fall outside the driver's valid memory scope. The driver dereferences these out-of-bounds pointers without validation in SYSTEM-privileged kernel context, corrupting kernel memory; with sufficient effort this can be converted from a reliable BSOD (DoS) into a controlled write primitive that overwrites a kernel function pointer or security token, granting the attacker SYSTEM-level process privileges. … |
| Remediation | Consult the Wibu-Systems AG security advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100057.pdf for the official patched release; the exact fixed version number is not independently confirmed in the available data and should be taken directly from that document. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running WibuKey version 6.70 or earlier and evaluate whether WibuKey64.sys driver is essential for business operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wibukey versions up to 6.51 contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7
Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-l
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70. Rated high severity (
An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds che
Same weakness CWE-119 – Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today