N A EUVD-2026-21014

Local user with standard privileges on Windows system running EnTech Taiwan PowerStrip version 3.90.736 or earlier with pstrip64.sys driver installed. No user interaction required. Attacker sends crafted IOCTL request to driver to map arbitrary physical memory and escalate to SYSTEM privileges.

Real-world risk is moderate and highly context-dependent. The CVSS base score of 7.8 reflects high impact (complete system compromise) but requires authenticated local access (PR:L), limiting attack surface to scenarios where an attacker already has a foothold. EPSS probability of 0.02% (5th percentile) suggests minimal automated exploitation activity, though the PacketStorm Security reference indicates documented exploit methodology exists. SSVC decision factors: exploitation status is POC-available (not active/widespread), technical impact is total system compromise, automatable exploitation is unlikely (requires local interactive session). Key risk multipliers: PowerStrip is discontinued/unsupported software (last update pre-2010), meaning no vendor patches will be released; organizations still running this for legacy display management have no remediation path except removal. In enterprise environments with application whitelisting and least-privilege enforcement, exploitation difficulty increases significantly. However, in gaming/enthusiast systems or poorly managed workstations where PowerStrip persists, the local privilege escalation becomes a viable post-exploitation pivot for ransomware operators or APT actors already inside the perimeter.

An attacker who has already compromised a standard user account on a Windows workstation (via phishing, credential theft, or application vulnerability) discovers PowerStrip installed. Using the publicly documented exploit methodology from PacketStorm Security, they compile a weaponized program that sends specially crafted IOCTL requests to \Device\pstrip64. The driver processes the malicious request without privilege checks, allowing the attacker's user-mode process to map physical memory pages containing kernel structures. The attacker locates their own process token in kernel memory and modifies privilege bits to grant SeDebugPrivilege and SYSTEM-level access, then spawns a command shell running as NT AUTHORITY\SYSTEM with full administrative control over the machine.